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Abstract 

When proving the correctness of algorithms in distributed systems, one generally consid- 
ers safety conditions and liveness conditions. The Input/Output (I/O) automaton model 
and its timed version have been used successfully, but have focused on safety conditions 
and on a restricted form of liveness called fairness. In this paper we develop a new I/O 
automaton model, and a new timed I/O automaton model, that permit the verification 
of general liveness properties on the basis of existing verification techniques. Our mod- 
els include a notion of environment-freedom which generalizes the idea of receptiveness of 
other existing formalisms, and enables the use of compositional verification techniques. 
The presentation includes an embedding of the untimed model into the timed model which 
preserves all the interesting attributes of the untimed model. Thus, our models constitute a 
coordinated framework for the description of concurrent and distributed systems satisfying 
general liveness properties. 
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1 Introduction 

The increasing need for reliable software has led the scientific community to develop many 
formalisms for verification. Particularly important are formalisms that can model distributed 
and concurrent systems and those that can model real time systems, i.e., systems that rely 
on time constraints in order to guarantee correct behavior. Formalisms should be able to 
support verification of both safety and Uveness properties [AS85]. Roughly speaking, a liveness 
property specifies that certain desirable events will eventually occur, while a safety property 
specifies that undesirable events will never occur. 

In this paper, we present a coordinated framework that permits modeling and verification 
of safety and liveness properties for both timed and untimed systems. The framework con- 
sists of two models, one timed and one untimed, with an embedding of the untimed model 
into the timed model. Both models come equipped with notions of external behavior and 
of implementation, which are based simply on traces. The framework is intended to support 
a variety of verification techniques, including simulation methods, compositional reasoning, 
algebraic methods, and temporal logic methods. 

A successful technique for the verification of safety properties and some special liveness 
properties is based on the simulation method of [AL91a, LV91, LV93a, LV93b, Jon91], applied 
to the Input/Output automaton model of [LT87] and to its generalization to the timed case 
[MMT91]. I/O automata are state machines with a labeled transition relation where the labels, 
also called actions, model communication. A key feature of I/O automata is the explicit 
distinction between their input and output actions, which characterize the events under the 
control of the environment and those under the control of the automaton, respectively. I/O 
automata can handle general safety properties and can also deal with a special kind of liveness, 
called fairness. Fairness captures the intuitive idea that each subcomponent of a composed 
system has fair chances to make progress. The notion of implementation for I/O automata, 
i.e., the way a concrete system is said to implement a more abstract specification, is expressed 
through fair trace inclusion, where a fair trace of an I/O automaton is a sequence of actions 
that can occur whenever the I/O automaton respects its fairness property. I/O automata can 
be composed in parallel, i.e., they can interact together so that they can be viewed as a single 
large system. An important property of I/O automata is that the implementation relation is 
compositional in the sense that it is always safe to replace a subcomponent in a large system 
with one of its implementations. Compositionality is needed for modular design techniques. 

Despite its success, the I/O automaton model is not general enough to handle some recent 
verification work in [SLL93, LLS93]. In particular, [SLL93, LLS93] provide examples where 
fairness is not adequate as a liveness condition. Moreover, the work in [SLL93, LLS93] has 
shown the need for a connection between timed and untimed models to prove that an implemen- 
tation that uses timing constraints correctly implements an untimed specification. The mutual 
exclusion algorithm of Fischer [Fis85, AL91b] is another instance of a timed implementation 
for an untimed specification. 

This motivates a generalization of the I/O automaton model and its timed version to handle 
general liveness properties in such a way that the simulation based proof method still applies. 



A simple and natural generalization is motivated by [AL93], which models a machine as a pair 
(A, L) consisting of an automaton and A and a subset L of its behaviors satisfying the desired 
liveness property. The implementation notion can then be expressed by live trace inclusion 
just as fair trace inclusion expresses implementation for I/O automata. The use of live trace 
inclusion as the implementation notion is motivated by the fact that the simulation based proof 
method is known to work for implementation notions based on some form of trace inclusion. 
Unfortunately, if L is not restricted, simple examples show that live trace inclusion is not 
compositional (cf. Examples 3.29 and 3.34). 

In this paper we identify the appropriate restrictions on L, in both the untimed model and 
the timed model, so that live trace inclusion is compositional for the pair (A, L). A pair (A, L) 
satisfying these restrictions on L is called a live I/O automaton in the untimed model and a live 
timed I/O automaton in the timed model. The restrictions on L are given by a property called 
environment- freedom , which captures the intuitive idea that a live (timed) I/O automaton 
must not constrain its environment. The environment-freedom property is defined, using ideas 
from [Dil88], by means of a two-person game between a live (timed) I/O automaton and its 
environment. Specifically, the environment provides arbitrary inputs while the system tries 
to react so that it behaves according to its liveness condition. A live (timed) I/O automaton 
(A, L) has a winning strategy against its environment if A can respond to any environment 
move in such a way that it will always eventually satisfy its liveness condition L. If a live 
(timed) I/O automaton has a winning strategy, then it is said to be environment-free. 

The definitions of the environment-freedom property in the untimed and the timed model 
are closely related. In particular, the environment-freedom property for the timed model 
is a natural extension of the environment-freedom property for the untimed model up to 
some technical details involving the so called Zeno behaviors. The close relation between the 
environment-freedom property in the untimed and the timed model allows the models to be tied 
together, thus permitting the verification of timed implementations of untimed specifications. 
Specifically, the paper presents a patient operator [NS92, VL92] that converts (untimed) live 
I/O automata into live timed I/O automata without timing constraints. The patient operator 
preserves the environment-freedom property and the live trace preorder relation of the untimed 
model. Thus, the patient operator provides the mechanism by which the timed and untimed 
models are unified into a coordinated framework. 

Our models generalize several existing models. The fairness condition of I/O automata 
satisfies the environment-freedom property; thus, live I/O automata are a proper generalization 
of I/O automata. Environment-freedom also implies feasibility as defined in [LS89]. The failure 
free complete trace structures of [Dil88] are also properly generalized by our model. In the 
timed case, our model generalizes [MMT91] and the notion of strong I/O feasibility introduced 
in [VL92]. Finally, in contrast to [AL91b], our timed model does not give either the system or 
the environment control over the passage of time. 

In order to extend the simulation based proof method to our model, we introduce an execu- 
tion correspondence theorem which builds on a similar lemma of [LT87] by extending the result 
to some of the simulation relations studied in [LV93a, LV93b]. The execution correspondence 
theorem says that the existence of a simulation relation between two automata induces a strict 



correspondence between their behaviors. The paper shows how such a correspondence can be 
used to prove live trace inclusion. 

We believe that our coordinated untimed and timed models comprise a good general 
framework for verification of concurrent systems. The models have already been used in 
[SLL93, LLS93] which deal with a non-trivial system, a communication protocol used in the 
Internet, and require all the new expressiveness and simulation tools provided in this paper. 

After some preliminary definitions, given in Section 2, the paper is divided into four main 
sections. Section 3 presents the untimed model, Section 4 presents the timed model, Sec- 
tion 5 embeds the untimed model into the timed model by means of the patient operator, 
and Section 6 extends the simulation method to live (timed) I/O automata. The presentation 
of both the untimed and timed models starts with a general automaton model with liveness 
conditions in the style of [AL91b]; then the I/O distinction is introduced together with the 
environment-freedom property. The presentation of the untimed model also includes several 
examples that motivate the definition of environment-freedom and show that there does not 
seem to be any trivial generalization of our environment-freedom property that still leads to 
the compositionality of the live trace preorder. Once live (timed) I/O automata are defined for 
each model, the paper introduces the corresponding notions of implementation and compares 
our model with other existing models. 

2 Preliminaries 

Notation for Natural Numbers 

Unless otherwise stated, indices like i, j, and k as well as the constant N range over the natural 
numbers N . The notation < i < oo, as well as the notation < i < oo, states that i is 
a positive natural number. Similarly, the notation {0,1,..., oo} denotes the set of natural 
numbers. 

Sequences 

We use "list" and "sequence" synonymously. The empty sequence is denoted by e. A finite se- 
quence li = e x . . . e„ and a sequence l 2 = e n+1 e n+2 . . . can be concatenated. The concatenation, 
written ^ " / 2 , or sometimes just lj 2 , is the sequence e x . . .e n e n+1 e n+2 . . .. 

A sequence l x is a prefix of a sequence / 2 , written /i < / 2 , if either l x = / 2 , or ^ is finite and 
there exists a sequence l[ such that l 2 = h " l[. 

For any sequence l 2 and any finite sequence ^ with /i < / 2 , we denote by l 2 — h the unique 
sequence l[ such that l 2 = h " l[. 

For any non-empty sequence / = eie 2 e 3 . . ., define head(l) to be e l7 the first element of /, 
and tail(l) to be the sequence e 2 e 3 . . ., the rest of /. 



Konig's Lemma 

The following lemma about digraphs is a generalization of Konig's Lemma. This generalization 
also appears in [LV93a]. A root in a digraph is a node with no incoming edges. 

Lemma 2.1 (Generalization of Konig's Lemma) 

Let G be an infinite digraph that satisfies the following properties: 

1. G has finitely many roots. 

2. Each node of G has finite outdegree. 

3. Each node of G is reachable from some root of G. 
Then there is an infinite path in G starting from some root. 

Proof. The usual proof of Konig's Lemma [K6n26] extends to this case. ■ 

3 Untimed Systems 

The discussion of untimed systems is organized as follows. Section 3.1 defines automata. 
Section 3.2 introduces live automata without I/O distinction. Section 3.3 defines safe I/O au- 
tomata by adding an Input/Output distinction to safe automata, and introduces the standard 
parallel composition, action hiding, and action renaming operators found in the literature. 
Section 3.4 introduces environment-freedom, defines live I/O automata, and extends the op- 
erators of Section 3.3. Thus, the presentation separates the issue of liveness from that of I/O 
distinction and environment-freedom. Section 3.5 defines two preorder relations, the safe pre- 
order and the live preorder, and shows in what sense the live preorder can express a notion of 
implementation. Section 3.6 compares our model with existing work. 

3.1 Automata 

The following definition of an automaton is given in the style of [LT87] and essentially describes 
a transition system. 

Definition 3.1 (Automaton) 

An automaton A consists of four components: 

• a set states(A) of states. 

• a nonempty set start(A) C states(A) of start states. 

• an action signature sig(A) = (ext(A), int(A)) where ext(A) and int(A) are disjoint sets 
of external and internal actions, respectively. Denote by acts(A) the set ext(A) U int(A). 



• a transition relation steps(A) C states(A) X acts(A) X states(A). ■ 

Thus, an automaton is a state machine with labeled steps. Its action signature describes the 
interface with the environment. It specifies which actions model events that are visible from 
the environment and which ones model internal events. 

An action a of automaton A is said to be enabled in state s if there exists a state s' such that 
the step (s,a,s r ) is an element of steps(A). 

An execution fragment a of an automaton A is a (finite or infinite) sequence of alternating 
states and actions starting with a state and, if the execution fragment is finite, ending in a 
state, 

a == S^a\ S\a 2 S 2 ' ' ' , 

where each triplet (s 8 , a J+1 , s J+1 ) is an element steps(A). Denote by fstate(a) the first state 
of a and, if a is finite, denote by Istate(a) the last state of a. Furthermore, denote by 
frag* (A), frag 1 " (A) and frag(A) the sets of finite, infinite and ah execution fragments of A, 
respectively. An execution is an execution fragment whose first state is a start state. Denote 
by exec*(A), exec" (A) and exec(A) the sets of finite, infinite and all execution of A, respectively. 
A state s of A is reachable if there exists a finite execution of A that ends in s. 

A finite execution fragment o^ = So a i s i ~'' a n s n of A and an execution fragment a 2 = 
s n a n+ is n+ i ■ ■ ■ of A can be concatenated . In this case the concatenation, written ai ~ a 2 , is the 
execution fragment So a i s i • • • a n s n a n+i s n+i • • •• 

An execution fragment o^ of A is a prefix of an execution fragment a 2 of A, written 
a i < a 2 7 if either ai = a 2 , or a^ is finite and there exists an execution fragment a[ of A such 
that a 2 = ai ~ a'j. 

Let a = s ais 1 a 2 s 2 • • • be an execution fragment. The length of a is the number of actions 
occurring in a. The length is infinite for infinite execution fragments. Define the ith prefix, 
ith suffix, and (i,j)- segment of a, for < i < j < \a\, as 



a 



a 




if i < | a | 

if a is finite and i = \a\ 



\iX 7 ' Oj tij_|_1 Oj_|_1 * * *U/ 7 'i' 7 ' 



The £race of an execution fragment a of an automaton A, written trace A (a), or just trace(a) 
when A is clear from context, is the list obtained by restricting a to the set of external actions 
of A, i.e., trace(a) = a \ ext(A), where \ is the standard restriction operator on lists. Let (3 
be a sequence of actions from acts(A). Then, trace A (ft), or just trace(fi) when A is clear from 
context, denotes the list obtained by restricting (3 to the set of external actions of A. For a set 
S of executions of an automaton A, denote by traces A (S), or just traces(S) when A is clear 
from context, the set of traces of the executions in S . We say that (3 is a trace of an automaton 
A if there exists an execution a of A with trace(a) = (3. Denote by traces*(A), traces" (A) and 
traces(A) the sets of finite, infinite and all traces of A, respectively. Note, that a finite trace 
might be the trace of an infinite execution. 

5 



3.2 Live Automata 

The automaton A of Definition 3.1 can be thought of as expressing the safety properties of a 
system, i.e, what always holds, or equivalently what is never supposed to happen. The Uveness 
properties of a system, i.e., what must eventually happen, can be expressed by a subset L of 
the executions of its safe part A, as proposed in [AL93]. Thus, informally, a live automaton is 
a pair (A, L) where A is an automaton and L is a subset of its executions. The executions of 
L, which satisfy both the safety and liveness requirements of (A, L), are the only ones that can 
occur in the described system. However, in order to ensure that the set L of executions does 
not introduce any more safety than is already given by A, it should not be possible to violate 
L in a finite number of steps. As a consequence, any finite execution of A must be extendible 
to an execution in L. In fact, if the safe part A of live automaton (A, L) has a finite execution 
a that cannot be extended to an execution in L, then a cannot occur in the system described 
by (A,L), and thus L introduces the additional safety property that a cannot occur. Our 
restriction on the pair (A, L) implies that the pair (exec(A), L) is machine-closed as defined in 
[AL93]. 

Definition 3.2 (Live automaton) 

A liveness condition L for an automaton A is a subset of the executions of A such that any finite 
execution of A has an extension in L, i.e., for each a £ exec* (A) there exists an a' £ frag(A) 
such that a ~ a' £ L. 

A live automaton is a pair (A,L), where A is an automaton and L is a liveness condition 
for A. The executions of L are called the live executions of (A,L). ■ 

Informally, a liveness condition can be used to express (at least) two intuitively different 
requirements. First, a liveness condition can be used to specify assumptions about the long- 
term behavior of a system that are based on its physical structure. For example, it is reasonable 
to assume that two independent processes running in parallel are both allowed to make progress 
infinitely often. In a physical system this is ensured by executing the two processes on separate 
processors or by using a fair scheduler in a multiprogramming environment. The notion of 
fairness of I/O automata [LT87] exactly captures this particular physical assumption. Second, 
a liveness condition can be used to specify additional properties that a system is required to 
satisfy. For example, in a mutual exclusion problem we may require a process to eventually 
exit the critical region whenever it enters it. 

Even though a liveness condition can express many specific intuitive ideas, for the purpose 
of this paper a liveness condition simply represents the set of executions that a system can 
exhibit whenever it is "working properly". 

3.3 Safe I/O Automata 

Our notion of safe I/O automaton is the same as the "unfair" I/O automaton of [LT87], i.e., 
the automaton obtained by removing the partition of the locally-controlled actions from an 
I/O automaton of [LT87]. 
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Definition 3.3 (Safe I/O automaton) 

A safe I/O automaton A is an automaton augmented with an external action signature, 
esig(A) = (in(A), out (A)), which partitions ext(A) into input and output actions. In each 
state, each input action must be enabled. A is said to be input-enabled. 

The internal and output actions of a safe I/O automaton A are referred to as the locally- 
controlled actions of A, written local(A). Thus, local(A) = int(A) U out(A). ■ 

The interaction between safe I/O automata is specified by the parallel composition operator. 
We use the synchronization style of [Hoa85, LT87], where automata synchronize on their com- 
mon actions and evolve independently on the others. We also retain the constraint of [LT87] 
that each action is under the control of at most one automaton by defining parallel compo- 
sition only for compatible safe I/O automata. Compatibility requires that each action be an 
output action of at most one safe I/O automaton. Furthermore, to avoid action name clashes, 
compatibility requires that internal action names be unique. 

Definition 3.4 (Parallel composition) 

Safe I/O automata Ai, . . . , A N are compatible if for all 1 < i, j ' < N with i ^ j, the following 
conditions hold: 

1. out(Ai) n out(Aj) = 

2. int(Ai) n acts(Aj) = 

The parallel composition A x || • • • || A N of compatible safe I/O automata Ai, . . . , A N is the safe 
I/O automaton A such that 

1. states(A) = states(Ai) X • • • X states(A N ) 

2. start(A) = start(Ai) X • • • X start{A N ) 

3. out(A) = out(A 1 ) U • • • U out(A N ) 

4. in(A) = (m(Ai) U • • • U in(A N )) \ out {A) 

5. int(A) = mf(Ai) U • • • U int(A N ) 

6. ((«i, • • • , Sjv), a, (s[, . . . ,s' N )) G steps(A) iff for all 1 < i < N 

(a) if a G acts(Ai) then (s 8 ,a,s') G steps(Ai) 

(b) if a ^ acts(Ai) then s, = s'- ■ 

The executions of the parallel composition of compatible safe I/O automata Ai, . . .,A N can 
alternatively be characterized as those executions that, when projected onto any component 
A,, yield an execution of A,. In particular, let A = A x || • • • || A N . First let s be a state of 



A. Then, for any 1 < i < N, define s\Ai to be s projected onto the i th component. Now, let 
a = s ais 1 a 2 s 2 • • • be an alternating sequence of states and actions such that s k £ states(A) 
and a k £ acts(A), for all k, and a ends in a state if it is a finite sequence. Define a [A;, 
where 1 < i < N, to be the sequence obtained from a by projecting its states onto their i th 
component and by removing each action not in acts(Ai) together with its following state. 

Lemma 3.5 

Let A = Ax || • • • || A N . Let a = s ais 1 a 2 s 2 • • • be an alternating sequence of states and actions 
such that s k £ states(A) and a k £ acts(A), for all k, and a ends in a state if it is a finite 
sequence. Then a £ exec(A) iff, for each i, a\A, £ exec(Ai) and Sj_i\Ai = Sj\Ai whenever 
aj £ acts(Ai). 

Proof. The lemma is a direct consequence of Corollary 8 of [LT87]. ■ 

The parallel composition operator could alternatively be defined as a commutative and associa- 
tive (up to isomorphism) binary operator. Thus, the parallel composition of N I/O automata 
could be obtained by applying the binary composition operator N — 1 times. We use the iV-ary 
parallel composition operator since it provides a simpler and more direct notation. Finally, the 
parallel composition operator is restricted to the composition of finitely many I/O automata 
in order to preserve compatibility with the timed model, where composition of infinitely many 
live timed I/O automata is not possible. 

Parallel composition is typically used to build complex systems based on simpler components. 
However, some actions are meant to represent internal communications between the subcom- 
ponents of the complex system. The hiding operator of [LT87] changes some external actions 
into internal actions. 

Definition 3.6 (Action hiding) 

Let A be a safe I/O automaton and let A be a set of actions such that A C local(A). Then 
define A \ A to be the safe I/O automaton such that 

1. states(A \ A) = states(A) 

2. start(A \ A) = start(A) 

3. in(A \ A) = in(A) 

4. out(A\ A) = out(A) \ A 

5. int(A \ A) = int(A) U A 

6. steps(A \ A) = steps(A) ■ 

Lemma 3.7 

Let A be a safe I/O automaton and A C local(A). Then exec(A \ A) = exec(A). 



Proof. The lemma is a direct consequence of Corollary 13 of [LT87]. ■ 

Several processes might be identical except for their actions' names. The processes of a token 
ring communication network provide a classical example. Such processes can be specified 
by first defining a generic automaton representing the functionality of a generic token ring 
process, and then creating an instance for each process by renaming the actions of the generic 
automaton via an action renaming operation. Action renaming can also be used to resolve 
name clashes that lead to incompatibilities in Definition 3.4. 

Definition 3.8 (Action renaming) 

A mapping p from actions to actions is applicable to a safe I/O automaton A if it is injective 
and acts(A) C dom(p). Given a safe I/O automaton A and a mapping p applicable to A, 
define p(A) to be the safe I/O automaton such that 

1. states(p(A)) = states(A) 

2. start(p(A)) = start(A) 

3. in(p(A)) = p{in(A)) 

4. out(p(A)) = p(out(A)) 

5. int(p(A)) = p(int(A)) 

6. steps(p(A)) = {(s,p(a),s r ) | (s,a, s') G steps(A)} ■ 

Lemma 3.9 

Let A be a safe I/O automaton and let p be a mapping applicable to A. For each execution 
a G exec(A), let p(a) be the sequence that results from replacing each occurrence of every 
action a in a by p{a). Then exec(p(A)) = {p(a) \ a G exec(A)}. 

Proof. The lemma is a direct consequence of Lemma 15 of [LT87]. ■ 

3.4 Live I/O Automata 

In defining live I/O automata one could follow the approach of Definition 3.2 and define a 
live I/O automaton to be a pair (A,L) where A is a safe I/O automaton and L is a liveness 
condition for A. However, such a naive definition would not capture the fact that a live I/O 
automaton should behave properly independently of the inputs provided by its environment. 
Given the structure of our liveness conditions, such independence from the environment will 
prove to play a fundamental role in the proofs for the closure of live I/O automata under 
parallel composition and the substitutivity of our trace based preorders. 



Example 3.10 

Let A be a the safe I/O automaton described by the diagram, 

A: 



a,b 



where a is an input action and b is an output action. Let L be the set of executions of 
A containing at least five occurrences of action a. L is trivially a liveness condition for A; 
however, the pair (A, L) would not behave properly if the environment does not provide more 
than four a actions (recall that behaving properly means being an execution of L). ■ 

Some of the problems arising from the requirement that a live I/O automaton should behave 
properly independently of the inputs provided by its environment are addressed in [Dil88, 
AL93]. Their solutions lead to the notion of receptiveness . Intuitively a system is receptive if 
it behaves properly independently of the inputs provided by its environment, or equivalently, if 
it does not constrain its environment. The interaction between a system and its environment 
is represented as a two person game where the environment moves consist of providing an 
arbitrary finite number of inputs, i.e., in our model, a finite number of input actions, and the 
system moves consist of performing at most one local step, i.e., in our model, at most one 
locally-controlled step. A system is receptive if it has a way to win the game (i.e., to behave 
properly) independently of the moves of its environment. The fact that an environment move 
can include at most a finite number of actions represents the natural requirement that the 
environment cannot be infinitely faster than the system. 

The behavior of the system during the game is determined by a strategy. In our model 
a strategy consists of a pair of functions (g, f). The function g decides which of the possible 
states the system reaches in response to any given input action; the function / determines the 
next move of the system. The move can be a local step or no step (_L move). 

Definition 3.11 (Strategy) 

Consider any safe I/O automaton A. A strategy defined on A is a pair of functions (g, /) where 
g : exec*(A) X in(A) — ► states(A) and / : exec* (A) — ► (local(A) X states(A)) U {_l_} such that 

1. g(a,a) = s implies aas £ exec* (A) 

2. f(a) = (a,s) implies aas £ exec* (A) ■ 

In the game between the environment and the system the moves of the environment are repre- 
sented as an infinite sequence I, called an environment sequence, of input actions interleaved 
with infinitely many A symbols. The symbol A represents the points at which the system is 
allowed to move. The occurrence of infinitely many A symbols in an environment sequence 
guarantees that each environment move consists of only finitely many input actions. 
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Suppose the game starts after a finite execution a. Then the outcome of a strategy (g,f), 
given a and an environment sequence X, is the extension of a obtained by applying g at each 
input action in X and / at each A in X. 

Definition 3.12 (Outcome of a strategy) 

Let A be a safe I/O automaton and (<?,/) a strategy defined on A. Define an environment 
sequence for A to be any infinite sequence of symbols from in(A) U {A} with infinitely many 
occurrences of A. Then define R( g j), the next-function induced by (g,f) as follows: for any 
finite execution a of A and any environment sequence X for A, 

(aas,X r ) if X = XX', f(ot) = (a,s) 
(a, I') if X = XX', /(a) = _L 
(aas,X r ) \iX = aX', g(a,a) = s 



R (g,f)( a > 1 ) = < 



Let a be any finite execution of A and X any environment sequence for A. The outcome 
sequence of (g,f) given a and X is the unique infinite sequence (a n ,X n ) n>0 that satisfies: 



• (a°,I°) = (a, I) and 



• for all n > 0, (a",X") = i2 (3j) (a"- 1 ,!"- 1 ). 
Note, that (a n ) n >o forms a chain ordered by prefix. 

The outcome 0( g j^(a,X) of the strategy (g,f) given a and X is the execution lim n ^oo a", 
where (a n ,X n ) n>0 is the outcome sequence of (g, /) given a and I and the limit is taken under 
prefix ordering. ■ 

Lemma 3.13 

Let A be a safe I/O automaton and (g, f) a strategy defined on A. Then for any finite execution 
a of A and any environment sequence X for A, the outcome 0( g j^(a,X) is an execution of A 
such that a < 0( g j^(a,X). ■ 

The concepts of strategies and outcomes are used to define formally the property that a system 
does not constrain its environment. This property is called environment-freedom. Informally, 
environment-freedom requires that there exists a strategy, called an environment-free strategy, 
that allows the system to win every game against its environment. In other words, every 
outcome of the environment-free strategy should be an element of L. An important feature 
of the definition of environment-freedom is that it considers outcomes where the environment- 
free strategy for (A, L) is applied after any finite execution of A. The discussion following the 
definition shows that this feature leads to a clean separation of safety and liveness properties. 
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Definition 3.14 (Environment-freedom) 

A pair (A,L), where A is a safe I/O automaton and L C exec(A), is environment-free if 
there exists a strategy (g,f) defined on A such that for any finite execution a of A and any 
environment sequence X for A, the outcome 0( g j^(a,X) is an element of L. The strategy (g, /) 
is called an environment-free strategy for (A,L). ■ 

Lemma 3.15 

Consider the pair (A,L), where A is a safe I/O automaton and L C exec(A). If (A,L) is 
environment- free, then L is a liveness condition for A. 

Proof. Consider any environment-free strategy (g,f) for (A,L), any finite execution a of A, 
and any environment sequence X for A. Then, since (g,f) is an environment-free strategy for 
(A, L), the outcome 0( g j/a,X) is an element of L. Furthermore, by Lemma 3.13, 0( g j/a,X) 
is an extension of a. Hence, any finite execution of A has an extension in L. ■ 

Definition 3.16 (Live I/O automaton) 

A live I/O automaton is a pair (A,L), where A is a safe I/O automaton and L C exec(A), 
such that (A, L) is environment-free. ■ 

Example 3.17 

Consider the safe I/O automaton A described by the transition diagram below. 




The unique start state of A is s . Action i is an input action and action o is an output action. 
Let L be the liveness condition for A consisting of the set of executions of A with at least one 
occurrence of action o. The pair (A, L) is not environment-free. Specifically, consider the finite 
execution a = s is A and the environment sequence I = AAA • • •. Performing action o after 
reaching state s 4 requires receiving an input i. Therefore, there is no strategy whose outcome 
given a and I is an execution in L. 

Define a new automaton A' from A by removing states s 4 ,s 5 ,s 6 , and let L' be the set 
of executions of A' containing at least one occurrence of action o. Then the pair (A',L r ) is 
environment-free. Function / chooses to perform action o whenever applied to an execution 
ending in s or s 2 and chooses _L otherwise; function g always moves to the only possible next 
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state. In [AL93] the pair (A, L) is said to be realizable and is identified with its realizable 
part (A,L r ). Realizability can be defined in our model by considering only those outcomes 
(9( 3 j)(a,I) where a consists of a start state. However, the approach of [AL93] implies that 
state s 4 should never be reached in (A,L), thus adding new safety requirements to A via 
L. It is the requirement of our environment-freedom condition that 0( g j^(a,T) C L for all 
a G exec* (A) which ensures that such new safety properties are not introduced. 

Let B be a safe I/O automaton that performs its unique output action i just once, and let 
L B be the set of executions of B. The pair (B,L B ) is trivially a live I/O automaton. It is 
easy to see that the parallel composition (A,L) || (B,L B ) is not even a live automaton. Thus, 
realizable pairs are not closed under parallel composition. The reader is referred to Section 3.6 
for more details. ■ 

Remark 3.18 

Note that for a pair (A, L) to be environment-free, all input actions must be enabled in all 
reachable states. Consider any reachable state s of A and any finite execution a of A leading to 
state s. Since a must be extendible for all input actions that the environment might provide, 
each input action must be enabled in s. For this reason safe I/O automata are required to be 
input-enabled by definition. ■ 

The parallel composition, hiding and renaming operators can now be extended to live I/O 
automata by using the results of Lemmas 3.5, 3.7, and 3.9. 

Definition 3.19 (Parallel composition) 

Live I/O automata (A l7 Li), . . . , (A N , L N ) are compatible iff the safe I/O automata Ai, . . . , A N 
are compatible. 

The parallel composition (Ai,Li) || ••• || (A N ,L N ) of compatible live I/O automata 
(Ai,Li), . . . , (A N , L N ) is defined to be the pair (A,L) where A = A x || • • • || A N and 
L = {a G exec(A) \ a\Ai G Li, . . . , a[~Ajv G L N }. ■ 

Definition 3.20 (Action hiding) 

Let (A, L) be a live I/O automaton and let A be a set of actions such that A C local(A). Then 
define (A, L)\Ato be the pair (A \ A, L). ■ 

Definition 3.21 (Action renaming) 

A mapping p from actions to actions is applicable to a live I/O automaton (A,L) if it is 
applicable to A. Let a be an execution of (A,L). Define p(a) to be the sequence that results 
from replacing each occurrence of every action a in a by p(a). Given a live I/O automaton 
(A, L) and a mapping p applicable to (A, L), define p((A, L)) to be the pair (p(A), {p(a) \ a G 
L}). m 
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All the operators above are closed for live I/O automata in the sense that they produce a new 
live I/O automaton whenever applied to live I/O automata. 

Proposition 3.22 (Closure of action hiding) 

Let (A,L) be a live I/O automaton and let A C local(A). Then (A,L) \ A is a live I/O 
automaton. 

Proof. To see that (A,L) \ A is a live I/O automaton it is sufficient to note that A \ A is a 
safe I/O automaton, L C exec(A \ A) (by Lemma 3.7), and that an environment-free strategy 
for (A, L) is also an environment-free strategy for (A, L)\A. ■ 

Proposition 3.23 (Closure of action renaming) 

Let (A, L) be a live I/O automaton and let p be a mapping applicable to (A, L). Then p((A, L)) 
is a live I/O automaton. 

Proof. To see that p((A, L)) is a live I/O automaton it is sufficient to note that p{A) is a safe 
I/O automaton, {p(a) \ a £ L} C exec(p(A)) (by Lemma 3.9), and that an environment-free 
strategy for (A,L) can easily be modified to be an environment-free strategy for p((A,L)). 
Specifically, since p is injective, any environment-free strategy (g,f) for (A,L) can be trans- 
formed into a new environment-free strategy (g p ,f p ) for p((A,L)) where 



g p (p(a),p(a)) = g(a,a) 



fM*)) = ± ' if/(a 




if /(«) = ( a , s ) 



_L 



The analysis for the parallel composition operator is more complicated and needs some technical 
lemmas. Given (A,L) = (Ai,Li) || ••• || (A N ,L N ), it is easy to see that A is a safe I/O 
automaton since its definition is based on the parallel composition of safe I/O automata. 
However, it is not as easy to see that the pair (A, L) is environment-free, and hence a live 
I/O automaton. The proof that (A,L) is environment-free uses a strategy (g,f) for (A,L) 
based on environment-free strategies (gi,fi) for each of the (Aj,£j), and shows that (g,f) is 
an environment-free strategy for (A,L). 

Function g should compute, given input a, the next state according to the g, functions of 
those components of A for which a is an input action, and simply leave the state unchanged 
for those components where a is not an action. 

Function / must ensure that every component of A gets a chance to control a step of 
A infinitely often. This fact accounts for much of the complexity in the definition of (g,f). 
Ensuring that every component of A gets a chance to control a step infinitely often would most 
naturally be done by assigning the control of steps to components in a round robin fashion. The 
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round robin based approach, however, would give rise to a technical problem in the definition 
of /: since the only argument to / is a finite execution a, the component whose turn it is to 
control the step in the round robin schedule must be determined from a. Unfortunately, the 
finite execution a does not include enough information to make this determination. Consider 
the following scenario. Assume that it is component A;'s turn to control the step after a finite 
execution a. Assume further that A, decides to perform a _L move and that the next input is a 
A symbol. In this case a will not change and, thus, it will again be A;'s turn to control the next 
step. Therefore, the round robin protocol is violated. The problem is, of course, that _L and 
A moves are "invisible" in a. One solution to this problem would be to let /be a function of 
"extended" executions that contain information about _L and A moves. The problem with this 
solution, however, is that it becomes messy due to the fact that this new notion of execution 
must keep track of _L and A moves of subcomponents of components, and so on. An alternative 
solution, adopted in our definition of /, uses the number of locally-controlled actions in a 
to determine which component controls a step. If the component controlling a step wants 
to perform a _L move but another component wants to perform a local step, a component 
wanting to perform the local step is given control. Thus a new locally-controlled action is 
added ensuring that another component will be given the opportunity to control the next step. 
Only if all components want to perform _L moves, does / yield a _L move. 

One final technicality in the definition of / is that it uses the g, functions. In particular, if 
a component performs a local step with action a, action a might be an input action of other 
components. In this case, the definition of / will need the g, functions of all those components 
for which action a is an input action. 

Definition 3.24 (Parallel composition of strategies) 

Let A = Ax || • • • || A N be the parallel composition of compatible safe I/O automata Ai, . . . , A N . 
For each finite execution a £ exec* (A), let 1(a) be the number of occurrences of locally- 
controlled actions of A in a, i.e., 1(a) = \a \ local(A)\, and let p(a) = (1(a) mod N) + 1. Let, 
for each 1 < i < N , (gi, fi) be a strategy defined on A,. 

The parallel composition (gi, fi) \\ ■ ■ ■ \\ (^ni/n) of the strategies (gi, fi), . . . ,(g N , f N ) is the 
pair of functions (g,f) defined as follows. 

Function g : exec* (A) X in(A) — ► states(A) is defined such that g(a,a) = s where, for each 
component Ai, 

s\Ai = 



gi(a\Ai,a) if a £ in(Ai) 
lstate(a)\Ai otherwise 



Function / : exec* (A) — ► (local(A) X states(A)) U {_l_} is defined for a based on the following 
cases: 

1. If there exists A, such that fi(a\Ai) ^ _L, then define k as follows. If f v ( a] (a\A v ( a] ) ^ _L, 
then k = p(a). Otherwise, k is the minimum index i such that fi(a\Ai) ^ _L. Now let 



15 



fki a \A k ) = (a,s k ) and define f(a) = (a,s) where, for each component Ai, 

s\Ai = 



s k if i = k 

gi(a\Ai,a) if a £ in(Ai) 



lstate(a)\Ai otherwise 

2. If fi(a\Ai) = ± for all A,- 

then f(a) = _L. ■ 

It is easy to see that the strategy of Definition 3.24 is indeed a strategy defined on A. 

Lemma 3.25 

Let Ai, . . . ,A N be compatible safe I/O automata and let, for each 1 < i < N, (gi, fi) be a 
strategy defined on A,. Then (gi, fi) \\ ■ ■ ■ \\ ($n, In) ?s a strategy defined on Ai \\ ■ ■ ■ \\ A N . 

Proof. Let A = A x || • • • || A N and (g,f) = (<7i,/i) || • • • || (#jv,.fjv)- From Definition 3.4, we 
know that A is a safe I/O automaton. Now the proof is a simple cases analysis on the different 
cases of Definition 3.24. In fact, for each one of those cases, it is sufficient to show that / and 
g give legal steps of A. ■ 

The following lemma is the key lemma for proving that the strategy of Definition 3.24 is 
environment-free if the component strategies are environment-free. The lemma shows that the 
projection of an outcome of the composed strategy onto any A, is an outcome of the strategy 
(gi, fi)- Intuitively, this means that, even though the composed system uses its composed 
strategy to find its outcome, it still looks to each component as if it was using its own component 
strategy. 

Lemma 3.26 

Let Ai, . . . ,A N be compatible safe I/O automata and, for each 1 < i < N, let (gi, fi) be a 
strategy defined on Ai. Let A = A x || • • • || A N and let (g, f) = (gi, fi) || • • • || ($n, /jv)- 

Furthermore, let a be an arbitrary finite execution of A, J be an arbitrary environment 
sequence for A, andi, with 1 < i < N , be an arbitrary index. Then, there exists an environment 
sequence I, for Ai such that 0( g j^(a,T)\Ai = 0( gt j t ^(a\Ai,Ti). 

Proof. From Definition 3.4 we know that A is a safe I/O automaton. Furthermore, by 
Lemma 3.25, (g,f) is a strategy defined on A. 

Let R( g j) and R( gi j { ) be the next-functions induced by (g,f) and (gi,fi), respectively. 
Also, let (a n ,T n ) n>0 be the outcome sequence of (g,f) given a and X. Then 0( g j/a,X) = 
liniyj^ooO!". Finally, for any finite execution a' £ exec*(A), let l(a') be the number of oc- 
currences of locally-controlled actions of A in a', i.e., l(a') = \a' \ local(A)\, and let p(a') = 
(l(a') mod N) + 1. (See Definition 3.24.) 
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The first step of the proof consists of constructing an environment sequence I, such that 
0( g j^(a,T)\Ai = 0(g t j^(a\Ai,2i). The construction of I, is inductive on n. Along with 
I;, the inductive definition constructs an outcome sequence (a J i ,J J i )j >0 of (gi,fi) given a\A, 
and I,, and a total nondecreasing mapping m with signature N — ► N , which, informally, 
maps elements of the outcome sequence (a n ,J n ) n>0 to their corresponding elements of the 
outcome sequence (a J i ,J J i )j >0 . The n th step of the inductive construction of I, defines the 
(m(n — 1) + l) th , • • • , m(n) th elements of I,, which are denoted by Xi, m (n-i)+i, • • • ,2i, m (n)- 

Along with the inductive definitions, three properties are proven: the first property shows 
the correspondence between a" and a™ n , the second and third property are used to show 
that (c4,2f)j> is indeed an outcome sequence of (g,, fi) given a\A, and I,. Formally, the 
properties are written as follows. 



1 then (a" 1 \e) = Rt Q . f .\(a^ n 1> ,l, l 



PI 


a n \A t =aT {n) . 


P2 


If re > and m(n) = m(n — 1) + 


P3 


If n > and m(n) = m(n — 1 




/ m(n) \ 7-> / m(n)—l .-?- 



/ m(n — 1) 
(9iJi)\ a i ,M,m(n)-l) 



2 then (af (n) \s) = R {qt t t) (af (n ^^Xi^M-i) and 



The base part of the proof is trivial. The inductive part of the proof is divided into cases based 
on the definition of R( g j) (< 
(g,f) (c.f. Definition 3.24). 



on the definition of R( g j) (c.f. Definition 3.12) and then subcases based on the definition of 



Base case n = 0: 

Define: ra(0) = 

a™(°) = a \Ai 

PI By definition. 

P2 Vacuously satisfied. 

P3 Vacuously satisfied. 

Inductive step n > 0: 

Assume P1-P3 hold for all k < n. The definition of R( g j) suggests three cases which are 
considered in order. 

Case 1 (a n ,l n ) = (a n - 1 as,tail(l n - 1 )) where /(a n_1 ) = (a,s) and head(J n - 1 ) = A. 
The definition of / in Definition 3.24 suggests the following sub cases: 

Case 1.1 p(a n ~ r ) = i and a ^ acts(Ai). 
Define: m(n) = m(n — 1) + 1 

m(n) m(n — l) 

a,- = a i 

-7" \ 
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PI Since p(a n r ) = i and a ^ acts(Ai), case 1 of the definition of / shows that 
s\Ai = lstate{a n - l )\Ai. Now, 
a n \Ai = (a n - 1 as)\A i 
1 a"- l \A t 

3 m(n — l) 

= a { 

4 m(n) 

= "i 

where steps f and 4 follow from the definitions made in this case, step 2 follows 
from the fact that s\Ai = lstate(a n ~ 1 )\A i and s ^ acts(Ai), and step 3 follows 
from the induction hypothesis. 
P2 Since p(a n ~ r ) = i and a ^ acts(Ai), case 1 of the definition of / shows 
that f i (a n ~ 1 \A i ) = _L. Based on the induction hypothesis f i (a'l in ~ ^ — 

" r \si,fi) 
P3 Vacuously satisfied. 



fi(a n 1 \A{), so /{(a™™ ') = _L. Now case two of the definition of R( 
confirms that (a" 1 " ,e) = R<„ f ^(a" 1 " - ,I 8 - 



Case 1.2 p(a n ) = i and a £ in(Ai). 
Define: m(n) = m(n — 1) + 2 

m(n)— 1 m(n — 1) 

a,- = a,- 

m(n) m(n)—l r * 

a j = a j as | A; 

-7- \ 

-L*i,m{n)—\ ^ 

PI In this case, 

a n \Ai = (a"- 1 as)\A i 
= a n - l \Aias\Ai 

3 m(n — 1) r A 

= a j 7 as|Aj 

4 m(n)— 1 r « 

= a, as I Ai 

5 m(n) 
= "i 

where steps 1, 4 and 5 follow from the definitions made in this case, step 2 
follows from the fact that a £ acts(Ai), and step 3 follows from the induction 
hypothesis. 

P2 Vacuously satisfied. 

P3 Since p(a n ~ r ) = i and a £ in(Ai), case 1 of the definition of / shows that 
fi(a n ~ 1 \A i ) = _L. Based on the induction hypothesis f i (a™' n ~ ') = f i (a n ~ 1 \A i ), 
so fi(a[' ) = _L. Now case two of the definition of R( gt j t ) confirms that 

/ m(n)—l \ r> / m(n — 1) .-?- \ 

K' ,£) = R{g,J,)\ a i ; ,2.i, m (n)-l)- 

Since a £ in(Ai), case 1 of the definition of / shows that g i (a n ~ 1 \A i ,a) = 
s\A{. Based on the induction hypothesis g i (a™' n ~ , a) = g i (a n ~ 1 \A i ,a). By 
definition g i (a™' n ' , a) = g i (a™' n ~ , a), so g i (a™' n ' , a) = s\A{. Now case 
three of the definition of R( gt j t ) shows that (a™^ ,e) = -R( 3i ,/;)(a!™ ,I 8 ' )m ( n ))- 
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Case 1.3 p(a n ) = i and a £ local(Ai) or p(a n ) ^ i and a £ local(Ai). 
Define: m(n) = m(n — 1) + 1 

m(n) m(n — l) r * 

a, ' = a 8 - v 'as\Ai 
■J \ 

PI In this case, 

a n \Ai = (a"- 1 as)\A i 
= a n - l \A ia s\Ai 

3 m(n — 1) r A 

= a 8 - v 'as\Ai 

4 m(n) 

= a- 
where steps 1 and 4 follow from the definitions made in this case, step 2 follows 
from the fact that a £ acts(Ai) and step 3 follows from the induction hypothesis. 
P2 Since a £ local(Ai), case 1 of the definition of / shows that f i (a n ~ 1 \A i ) = 
(a,s\A{). Based on the induction hypothesis f i (a™' n ~ ') = f i (a n ~ 1 \A i ), so 
fi( a T ) = (a,s\Ai). Now case one of the definition of R( gi j,) confirms that 

/ m(n) \ r> / m(n — 1) .-?- \ 



P3 Vacuously satisfied. 
Case 1.4 p(a n ) ^ i and a £ in(Ai) 



Define: m\ 


in)-- 


= m( 


n- 1) + 1 




af n) : 


rr. 
= OLi 


■'""''a^A, 




£, 


m(n) 


= a 




PI 


In this 


case 


•> 






a n \Ai 


1 


(a"' 


_1 as)rA,- 






2 
3 

4 


a n ~ 
a { 

m('t 

(X; 





where steps 1 and 4 follow from the definitions made in this case, step 2 follows 
from the fact that a £ acts(Ai) and step 3 follows from the induction hypothesis. 
P2 Since a £ in(Ai) case 1 of the definition of / shows that g i (a n ~ 1 \A i ,a) = 
s\A{. Based on the induction hypothesis g i (a™' n ~ , a) = gi{a n ~ 1 \A{, a), so 
9i( a T ■> a ) = s\A{. Now case three of the definition R( gi j,) confirms that 

/ m(n) \ r> / m(n — 1) .-?- \ 

("i ,£) = R{g,J,)\ a i ,M,m(n))- 

P3 Vacuously satisfied. 

Case 1.5 p(a n ) ^ i and a ^ acts(Ai). 
Define: m(n) = m(n — 1) 
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PI Since p(a n r ) ^ i and a ^ acts(Ai), case 1 of the definition of / shows that 
s\Ai = lstate{a n - l )\Ai. Now, 
a n \Ai = (a n - 1 as)\A i 
1 a"- l \A t 

3 m(n — l) 

= a { 

4 m(n) 

= "i 

where steps f and 4 follow from the definitions made in this case, step 2 follows 
from the fact that s\Ai = lstate(a n ~ 1 )\A i and a ^ acts(Ai), and step 3 follows 
from the induction hypothesis. 

P2 Vacuously satisfied. 

P3 Vacuously satisfied. 



Case 2 (a n ,l n ) = (a"" 1 , tail{l n - 1 )) where /(a n_1 ) = _L and head(2 n - v ) = A. 
Define: m(n) = m(n — 1) + 1 

m(n) m(n — l) 

a,- = a,- 

-7" \ 

PI In this case, 

a n \Ai = a n ~ l \Ai 

3 m(n — l) 

= a { 

4 m(n) 

= a- 
where steps 1 and 3 follow from the definitions made in this case, step 2 follows from 
the induction hypothesis. 

P2 Since f(a n ~ r ) = _L, case 2 of the definition of/ shows that f i (a n ~ 1 \A i ) = _L. Based 
on the induction hypothesis f i (a™' n ~ ') = f i (a n ~ 1 \A i ), so f i (a™' n ~ ') = _L. Now 
case two of the definition of R( gi j,) confirms that (a™ , £) = R( g ,j,){c«T ,2i, m (n))- 

P3 Vacuously satisfied. 



Case 3 (a n ,l n ) = (a n - 1 as,tail(J n - 1 )) where g(a n ~ 1 ,a) = s and head(2 n - v ) = a. 
The definition of g in Definition 3.24 suggests the following sub cases: 

Case 3.1 a £ in(Ai). 

Define: m(n) = m(n — 1) + 1 

m(n) m(n — l) r * 

a, ' = a 8 - v 'as\Ai 
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PI In this case, 

a n \Ai = (a n - 1 as)\A i 
= a n - l \Aias\Ai 

3 m(n — 1) r A 

= a 8 - v 'as\Ai 

4 m(n) 
= "i 

where steps 1 and 4 follow from the definitions made in this case, step 2 follows 
from the fact that a £ acts(Ai) and step 3 follows from the induction hypothesis. 

P2 The definition of g shows that g i (a n ~ 1 \A i ,a) = s\Ai. Based on the induction 
hypothesis, g i (a™' n ~ , a) = gi{a n ~ 1 \A{, a), so g i (a™' n ~ , a) = s\A{. Now case 
three of the definition of R( gt j t ) shows that (a™ n ,e) = R( g ,j,){c«T ,^,m(n))- 

P3 Vacuously satisfied. 

Case 3.2 a £ in(Ai). 

Define: m(n) = m(n — 1) 

PI The definition of g shows that s\Ai = lstate(a n ~ 1 )\A i . Then, 
a n \Ai = (a n - 1 as)\A i 
1 a"- l \A t 

3 m(n — 1) 

= a,- 

4 m(n) 

= "i 

where steps 1 and 4 follow from the definitions made in this case, step 2 follows 
from the fact that s\Ai = lstate(a n ~ 1 )\A i and a ^ acts(Ai), and step 3 follows 
from the induction hypothesis. 

P2 Vacuously satisfied. 

P3 Vacuously satisfied. 

This concludes the inductive definition and induction proof. 

The second part of the proof consists of showing that I, is indeed an environment sequence 
for A,. Denote the generic j th element of I, by 2^-. The sequence I, is well defined since 
1-i,m(n) is defined whenever m(n) = m(n — 1) + 1 and Ti im ( n )-i an d Xj )m ( n ) are defined whenever 
m(n) = m(n — 1) + 2. Showing that I, is an environment sequence for A, induces two proof 
obligations: 

1. lij e in(Ai) U {A} for all j > 0. 

This follows immediately from the definition of 2^- in the induction. 

2. There are infinitely many j > such that 2^ = A. 

Since 2 is an environment sequence, it contains infinitely many elements. Thus, the 
induction has infinitely many steps (i.e., n — ► oo). For every step, all cases of the 
induction except 1.4, 1.5, 3.1, and 3.2 define a new element 2 8J ' such that 2 8J ' = A. Thus, 
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the proof obligation is met as long as there exists no n > such that for all n > n 
every step of the induction leads to case 1.4, 1.5, 3.1, or 3.2. For a contradiction assume 
such an n exists. Consider the following observations about cases 1.4, 1.5, 3.1 and 3.2. 
If the n th step leads to cases 3.1 or 3.2, then l(a") = l(a n ~ r ). If the n th step leads to 
case 1.4 or 1.5, then l(a n ) = l(a n ~ r ) + 1. Furthermore, cases 1.4 and 1.5 require that 
p(a n ~ 1 ) ^ i, where p(a n ~ 1 ) = (/(a" -1 ) mod N) + 1. Thus, since N is finite, there can be 
at most finitely many steps after the ra* ft step that lead to case 1.4 or 1.5, i.e., as many 
as necessary to get p(a n ~ 1 ) = i. In other words, there exists a number n x > n such that 
for each n > rii the ra th step leads to case 3.1 or 3.2. However, since X is an environment 
sequence, for infinitely many n such that n > n , head(X n ~ 1 ) = A. Now there is a 
contradiction since the n th step cannot lead to case 3.1 or 3.2 when head(X n ~ 1 ) = A. 

An immediate consequence of the fact that I, contains infinitely many A symbols is that 
lim n ^oo m(n) = oo. In fact, m(n) > m(n — 1) whenever I m ( n ) = A. 

The final step of the proof consists in showing that (a",I")„> is the outcome sequence of 
(gi, fi) given a\A, andl,, and thus that 0( g j^(a,T)\Ai = 0( gt j^(a\Ai,2i). Let I" denote the 
suffix of I, generated by removing the first n elements of I,. By definition, (a?, I?) = (a|"A;,2j). 
Thus it must be verified that for all n > 0, «,If) = j R (3ii/i) «" 1 ,I"" 1 ). This fact follows 
directly from P2 and P3 and the following observation: "For any strategy (g',f) defined on 
any safe I/O automaton A', any pair of executions a', a" £ exec*(A'), and any environment 
sequence!', (a' ,tail(I')) = i2(yj<)(a",Z') iff (ot',e) = R( g i j')(ot" \head(I')). v Since (a",J") n>0 
is an outcome sequence of (gi, fi) given a\A, and I,, the definition of an outcome shows that 
(gt j t) (a\Ai,Ji) = lim n ^ 00 a?. Thus, 
(g j ) (a,2)\Ai = (lim„^ 00 a")[A i 

= lim n ^ 00 (a n \A i ) 

= lim n ^ 00 (a™ (n) ) 

= lim n ^ 00 «) 

= (9tJi} (a\A r li) 
where step 1 follows from the definition of a" , step 2 follows from the continuity of the pro- 
jection operator, step 3 follows from PI, step 4 follows from the fact that lim n ^oo m(n) = oo 
and the family (a") n>0 form a chain ordered under prefix, and step 5 from the fact that 

(gt j t) (a\Ai,Ji) = lim n ^ 00 <. ■ 

Lemma 3.27 

Let (Ai, Li) . . . , (A N , L N ) be compatible live I/O automata and, for each 1 < i < N , let (gi, fi) 
be an environment-free strategy for (Ai,Li). Then (gi, fi) \\ • • • \\ (gN,fN) is an environment- 
free strategy for (A 1 ,L 1 )\\ •••|| (A N ,L N ). 

Proof. Let (A, L) = (A 1 ,L 1 ) || • • • || (A N ,L N ) and (g,f) = (gi, fi) || • • • || (g N ,fN)- From 
Definition 3.4, we know that A is a safe I/O automaton. Furthermore, from Definition 3.19, 
Lemma 3.5, and the fact that each Li C exec(Ai), the set L is a subset of exec(A). 



22 



Consider any environment sequence X for A and any finite execution a of A. By Lemma 3.26 
there exists for all A, an environment sequence I, such that 0( g j/a,X)\Ai = 0( gt j t ^(a\Ai,Xi). 
Since (g,, fi) is an environment-free strategy for (Ai,Li), 0( gt j t ^(a\Ai,Xi) £ Li Consequently, 
0( g j^(a,T)\Ai £ Li for all (Ai,Li). From Definition 3.19, 0( g j^(a,X) £ L. Thus (g,f) is an 
environment-free strategy for (A,L). ■ 

Proposition 3.28 (Closure of parallel composition) 

Let (Ai, Li), . . ., (A N , L N ) be compatible live I/O automata. Then (Ai, Li) || • • • || (A N , L N ) is 
a live I/O automaton. 

Proof. Let (A,L) = (Ai,Li) || ••• || (A N ,L N ). From Definition 3.4, we know that A is a 
safe I/O automaton. Furthermore, from Definition 3.19, Lemma 3.5, and the fact that each 
Li C exec(Ai), the set L is a subset of exec(A). 

For each 1 < i < N, let (g,, /,) be an environment-free strategy for (Ai, Li). By Lemma 3.27 
the strategy (g, /) = (g l7 /j) || • • • || (gN, In) is an environment-free strategy for (A, L). There- 
fore, the pair (A,L) is environment-free. Thus, from Definition 3.16, (A,L) is a live I/O 
automaton. ■ 

Environment-freedom is a crucial property of live I/O automata since it guarantees that no 
pair of compatible live I/O automata constrain each other's environments. In particular, if 
pair (A, L) is not environment-free, the parallel composition operator may generate pairs that 
are not even live automata. 

Example 3.29 

Consider safe I/O automata A and B described by the state transition diagrams below. 

A: ^ s a B : ^ s b 



For A, action b is an input action, and action a is an output action; for B, action a is an 
input action and action b is an output action. Let the liveness condition L A for A be the set 
of executions a of A such that trace(a) ends in (a6)°° or a°°, and let the liveness condition L B 
for B be the set of executions a of B such that trace(a) ends in (aabb) 00 or 6°°. 

The pairs (A,L A ) and (B,L B ) are not environment-free. To see that (A,L A ) is not 
environment-free consider the environment sequence I = bbXbbX---; to see that (B,L B ) is 
not environment-free consider the environment sequence I = aaaXaaaX ■ ■ ■. 

Let (C,L C ) = (A, La) \\ (B,L B ). In this case, L c = 0. Thus L c is not a liveness condition 
for C, which means that (C, L c ) is not even a live automaton. ■ 
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Example 3.29 also exposes the flaw in a simpler and more intuitive definition for environment- 
freedom we originally considered for this paper. The simpler definition, which is a natural 
generalization of the fairness condition of [LT87] and is also discussed in [LS89], states that "a 
pair (A, L) is environment-free if for each finite execution a of A and each (finite or infinite) 
sequence (3 of input actions there is an execution fragment a' of A such that a' \in(A) = (3 
and a ~ a' £ L." It is easy to see that the pairs (A,L A ) and (B,L B ) of Example 3.29 are 
both environment-free based on the simpler definition. However, the example shows that their 
composition cannot be a live I/O automaton. The problem with the simpler definition is that 
it allows the system to choose its relative speed with respect to the environment, and it allows 
the system to base its decisions on the future behavior of the environment. Example 3.29 shows 
that the simpler definition thus gives the system too much power for parallel composition to 
be closed. 

3.5 Preorder Relations for Live I/O Automata 

In [LT87, Dil88, AL93] the notion of implementation is expressed through some form of trace 
inclusion. Similar notions of implementation can be defined on live I/O automata. In particular 
it is possible to identify two preorder relations, the safe and the live preorders, which aim at 
capturing the safety and liveness aspects of live I/O automata, respectively. 

Definition 3.30 (Trace preorders) 

Given two live I/O automata (Ai,Li) and (A 2 ,L 2 ) such that esig(Ai) = esig(A 2 ), define the 
following preorders: 

Safe: (Ai,Li) C s (A 2 ,L 2 ) iff traces(Ai) C traces(A 2 ) 

Live: (Ai,Li) C L (A 2 ,L 2 ) iff traces(Li) C traces(L 2 ) ■ 

The safe preorder is the same as the unfair preorder of I/O automata [LT87], while the live 
preorder is a generalization of the fair preorder of [LT87]. In particular, the live preorder 
coincides with the fair preorder if, for each live I/O automaton (A,L), L is chosen to be the 
set of fair executions of A. The conformation preorder of [Dil88], which expresses the notion 
of implementation for complete trace structures, coincides with the live preorder when dealing 
with failure free complete trace structures. Finally, the notion of implementation of [AL93], 
which works in a state based model, coincides with the live preorder up to a different notion 
of traces arising from the state structure of the model. In [AL93], a system Mi implements a 
system M 2 iff the set of "traces" of the realizable part of Mi is a subset of the set of "traces" 
of the realizable part of M 2 . Furthermore, if a system M is receptive, then M is equal to its 
realizable part. Thus, for receptive systems, the implementation notion of [AL93] is just the 
live trace preorder. The reader is referred to Section 3.6 for more details about realizability. 

It is interesting to note that the live preorder implies the safe preorder whenever the involved 
automata have finite internal nondeterminism. On the other hand, if the involved automata do 
not have finite internal nondeterminism, the live preorder only implies finite trace inclusion. 
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Essentially, finite internal nondeterminism requires that a live I/O automaton has a finite 
internal branching structure. In particular, an external action can lead to only a finite number 
of states, and a state may enable at most a finite number of internal actions. 

Definition 3.31 (Finite internal nondeterminism) 

An automaton A has finite internal nondeterminism (FIN) iff, for each finite trace (3 £ 
traces* (A), the set {Istate(a) \ a £ exec* (A), trace(a) = (3} is finite. ■ 

Proposition 3.32 

Let (Ai,Li) and (A 2 ,L 2 ) be two live I/O automata with esig(Ai) = esig(A 2 ). 

1. If(A 1 ,L 1 ) C L (A 2 ,L 2 ) then traces* (A x ) C traces*(A 2 ) 

2. If A 2 has FINand{A u L 1 ) ^{A 2 ,L 2 ), then{A u L 1 ) C s (A 2 ,L 2 ) 

Proof. 

1. Let (3 be a finite trace of A±. By definition of trace, there is an execution o^ of A x such 
that trace(ai) = (3. By definition of a live I/O automaton there exists an execution a[ of 
Ax such that a.\ < a[ and a[ £ L\. Since {Ax,L/) C L (A 2 ,L 2 ), there exists an execution 
a' 2 of L 2 such that trace(a[) = trace(a' 2 ). By definition of a live I/O automaton, a' 2 is an 
execution of A 2 , and, since the set of executions of an automaton is closed under prefix, 
there is a prefix a 2 of a 2 such that a 2 is an execution of A 2 and trace(a 2 ) = (3, i.e., (3 is 
a trace of A 2 . 

2. Finite trace inclusion follows directly from part 1. Infinite trace inclusion follows from 
finite trace inclusion, closure under prefix of trace sets, and the fact that trace sets 
of automata with finite internal nondeterminism are closed under prefix ordering limit 

[LV91]. ■ 

The proof of Proposition 3.32 supports the requirement of our definition of a liveness condition 
(Definition 3.2) that every safe execution be extendible to a live execution. Without this 
requirement, the live preorder could not be used to infer the safe preorder, i.e., neither part of 
Proposition 3.32 would hold. 

An important goal of this paper is the substitutivity of the safe and live preorders for the 
operators of Section 3.4. In the case of the parallel composition operator, this means that 
an implementation of a system made up of several parallel components can be obtained by 
implementing each component separately. 

Theorem 3.33 (Substitutivity) 

Let (Ai, Li), (A,-, L'A, i = 1,...,N be live I/O automata, and let C x be either C s or C L . If, 
for each i, (Ai,Li) C x (A\,L'/), then 
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1. if (A l7 Li), . . . , (A N , L N ) are compatible and (A[, L[), . . . , (A' N , L' N ) are compatible then 
(A 1 ,L 1 )\\...\\(A N ,L N )Q X (A' 1 ,L' 1 )\\...\\(A' N ,L' N ) 

2. if A C local{A{) and A C local(A[) then 
(A 1 ,i 1 )\AC x (A' 1 ,i' 1 )\A 

3. if p is a mapping applicable to both A x and A[ then 

piiA^L^QxpiiA^L'J) 

Proof. The substitutivity results for the safe trace preorder are already proven in [LT87]. 
The substitutivity results for the live trace preorder follow directly from the definitions of 
the parallel composition, hiding, and renaming operators after observing, as it is proved in 
Corollaries 8, 13 and Lemma 15 of [LT87], that parallel composition, hiding and renaming of 
execution sets preserve trace equivalence. ■ 

The following example shows that the absence of environment-freedom can lead to situations 
where the substitutivity result of Theorem 3.33 breaks down. 

Example 3.34 

Consider the safe I/O automata Ai,A 2 , and A 3 with the transition diagrams below. 

A x A 2 A 3 



where a and b are output actions for A x and A 2 and are input actions for A 3 . Let L\ (resp. L 2 ) 
be the set of executions of A x (resp. A 2 ) containing at least one action and let L 3 be the set 
of executions of A 3 containing at least one occurrence of action a immediately followed by an 
occurrence of action b. It is easy to check that (Ai, Li) and (A 2 , L 2 ) are both environment-free, 
but (A 3 ,L 3 ) is not environment-free since it requires at least one input. 

Observe that (Ai, Li) C L (A 2 , L 2 ) and that (A 2 , i 2 )||(A 3 , L 3 ) is environment-free and thus a 
live I/O automaton. One might want to conclude that (A l7 i 1 )||(A 3 , L 3 ) C L (A 2 ,L 2 )\\(A 3 ,L 3 ). 
Unfortunately, this conclusion is false. In particular, let (A,L) = (A l7 i 1 )||(A 3 , L 3 ). Then, the 
set L is not a liveness condition since A x can never perform an action a followed by an action 
b. Thus, the fact that (A 3 ,i 3 ) is not environment-free causes situations where the parallel 
composition with (A 3 ,i 3 ) fails to lead to a pair (A,L) where L is a liveness condition. This 
in turn causes the substitutivity of the parallel composition operator to fail. ■ 

There are several ways in which the live preorder can be justified as an adequate notion of 
implementation for live I/O automata. Since the live preorder captures the implementation 
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notions of [LT87, Dil88, AL93] it can rest on the justifications provided for these implementa- 
tion notions. For example, the fair preorder of [LT87] is justified by two observations. First, 
the fact that I/O automata are input-enabled guarantees that a system must respond to any 
environment. In our model the same property is guaranteed by the concept of environment- 
freedom. Second, by restricting attention to fair traces the correctness of an implementation 
is based only on executions where the system behaves fairly. In our model this property is 
guaranteed by restricting attention to live traces. 

An additional justification for the live preorder as a notion of implementation is based on 
the concepts of safety and liveness properties. It is easy to see that the safe preorder preserves 
the safety properties of a system, i.e., the safe preorder guarantees that an implementation 
cannot do anything that is not allowed by the specification. The live preorder, on the other 
hand, preserves the liveness properties of a system, thus guaranteeing that an implementation 
must do something whenever it is required to by the specification. Informally, if after a sequence 
of actions (3 something has to happen, (3 is not a live trace of the specification, and thus not 
a live trace of the implementation. Therefore, even in the implementation something has to 
happen after (3 has occurred. If the involved systems have finite internal nondeterminism, then 
the live preorder implies the safe preorder. Thus the live preorder guarantees both safety and 
liveness properties. 

3.6 Comparison with Other Models 

This section compares our model with the models of [Dil88, LT87, AL93] and the work of 
[RWZ92]. 

The model of complete trace structures of [Dil88] is a special case of our model. Specifically, 
the model of [Dil88] does not include a state structure, so that the safe part of a live automaton 
in [Dil88] is given by a set of traces. Since there is no notion of a state in a complete trace 
structure, a strategy for a system is simpler than our strategies in the sense that function 
g is not necessary and that function / simply picks up a locally-controlled action based on 
previous environment moves. By ignoring the state structure of a system, the model in [Dil88] 
may erroneously view as receptive a state machine that is not environment-free based on our 
model since its traces may be receptive. Thus, complete trace structures are not adequate 
whenever the state structure of a system is important. 

The I/O automaton model of [LT87] is also a special case of our model. An I/O automaton 
M of [LT87] can be represented in our model as the environment-free pair (A,L), where A is 
the I/O automaton M without the partition of its locally-controlled actions and L is the set 
of fair executions of M. The environment-free strategy (g,f) for (A,L) is defined in such a 
way that g picks up any possible next state in response to an input action, while / gives fair 
turns to proceed (say in a round robin way) to all the components of M that are continuously 
willing to perform some locally-controlled action. Thus [LT87] can only express some special 
cases of our general liveness conditions. 

The model of [AL93] is based on unlabeled state transition systems and is suitable for the 
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modeling of shared memory systems. An action in [AL93] is identified with a set of transi- 
tions, and transitions are partitioned into environment transitions and system transitions. The 
environment moves by performing an arbitrary finite number of environment transitions and 
the system responds by performing zero or one system transitions. Function g is not necessary 
in a strategy for a system of [AL93] since the environment chooses the next shared state in its 
move and does not modify the internal state. Function / chooses a new transition based on 
the past history of the system. 

A fundamental difference between [AL93] and our work is in that we define environment- 
freedom by requiring the existence of a strategy that can "win the game" after any finite execu- 
tion a, whereas [AL93] considers a weaker property, called realizability , where the requirement 
is the existence of a strategy that can win starting from any start state (cf. Example 3.17). 
The realizable part of a system of [AL93] is the set of behaviors that can be the outcome of 
some strategy. A system is then receptive if it coincides with its realizable part. The notion of 
receptiveness of [AL93] corresponds to our notion of environment-freedom, as can be derived 
easily from Proposition 9 of [AL93]. 

Example 3.17 shows a live automaton (A,L), which is not environment-free. However, 
(A, L) is realizable, and (A 1 , L'), which is defined in the same example, is the realizable part of 
(A,L). In [AL93] systems are compared based on their realizable parts. Thus, it is necessary 
to determine the realizable part of a system before its safety properties can be determined, 
and for this reason realizable systems are closed under parallel composition in [AL93]. In 
other words, L can add new safety properties to A. However, later in [AL93] a notion of 
machine-realizability is introduced which separates safety and liveness properties and requires 
receptiveness, or equivalently environment-freedom, just like our live I/O automata. 

Finally, it is easy to show, given our definition of environment-freedom, that the set of live 
traces of any live I/O automaton is union-game realizable according to [RWZ92], and thus 
describable by means of a standard I/O automaton of [LT87]. However, in general the I/O 
automaton description would involve a lot of encoding and would be extremely unnatural. 

4 Timed Systems 

The notion of liveness discussed in the previous section is now extended to the timed model. 
Section 4.1 introduces timed automata along with timed executions and timed traces, and 
shows the relationship between the new timed executions and the ordinary executions from 
the untimed model. Section 4.2 introduces live timed automata. Section 4.3 defines safe timed 
I/O automata by introducing the Input/Output distinction. Section 4.4 extends the notion 
of environment-freedom to the timed model and defines live timed I/O automata. Section 4.5 
introduces several preorders on live timed I/O automata, one of which is used to express a 
notion of implementation. Finally, Section 4.6 compares our model with existing work. Since 
Examples 3.10, 3.17, 3.29, and 3.34 apply equally to the timed model, our discussion focuses 
on issues specific to the timed model. 
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4.1 Timed Automata 

The following definition of a timed automaton is the same as the corresponding definition 
in [LV93b] except for the fact that our definition allows multiple internal actions. Also, the 
notions of timed executions and timed traces are the same as the definitions of [LV93b]. The 
definitions are repeated here but the reader is referred to [LV93b] for further details. Times 
are specified using a dense time domain T. In this work, as in [LV93b], let T be R-°, the set 
of non-negative reals. 

Definition 4.1 (Timed automaton) 

A timed automaton A is an automaton whose set of external actions contains a special time- 
passage action v. Define the set of visible actions to be vis (A) = ext(A) \ {z/}. 

As an additional component, a timed automaton contains a mapping now A : states(A) — ► T 
(called now when A is clear from context), indicating the current time in a given state. 

Finally, A must satisfy the following five axioms 

51 If s G start (A) then s.now = 0. 

52 If (s,a,s') G steps(A) and o/v, then s' .now = s.now. 

53 If (s,u, s') G steps(A) then s' .now > s.now. 

54 If (s,u, s') G steps(A) and (s',u, s") G steps(A), then (s,u, s") G steps(A). 

To be able to state the last axiom, the following auxiliary definition is needed. Let / be an 
interval of T. Then a function uj : / — ► states(A) is an A-trajectory, sometimes called trajectory 
when A is clear from context, if 

1. uj(t).now = t for all t G I, and 

2. (u(t),u,u(t')) G steps(A) for all t,t' e I with t < t' . 

That is, uj assigns to each time t in the interval / a state having the given time t as its now 
component. The assignment is done in such a way that time-passage steps can span between 
any pair of states in the range of uj. Denote inf(I) and sup(T) by ftime(uj) and Itime(uj), 
respectively. If / is left closed, then denote uj(ftime(uj)) by fstate(uj). Similarly, if / is right 
closed, then denote uj(ltime(uj)) by Istate(uj). If / is closed, then uj is said to be an ^.-trajectory 
from fstate(uj) to Istate(uj). An ^.-trajectory uj whose domain dom(uj) is a singleton set [t,t] is 
also denoted by the set {uj(t)}. The range of uj is denoted by rng(uj). 

The final axiom then becomes 

55 If (s,u, s') G steps(A) then there exists an ^.-trajectory from s to s' . ■ 

Axiom SI states that time must be in any start state. Axiom S2 says that non-time-passage 
steps occur instantaneously. In this framework, operations with some duration in time are 



29 



modeled by a start action and an end action. Axiom S3 says that time-passage steps cause 
time to increase. Axiom S4 gives a natural property of time, namely that if time can pass in 
two steps, then it can also pass in a single step. Finally, Axiom S5 says that if time can pass 
from time t to time t' , then it is possible to associate states with all times in the interval [t,f] 
in a consistent way. In [LV93b] the last axiom is explained further and compared to the weaker 
axiom that says the following: if time can pass in one step, then it can pass in two steps with 
the time of the intermediate state being any time in the interval. 

Timed Executions 

Section 3 introduced the notions of execution and trace for automata. These notions carry 
over to timed automata with the addition of one new idea. 

In particular, the notion of execution only allows one to associate states with a countable 
number of points in time, whereas the trajectory axiom S5 allows one to associate states with 
ah real times. Also, the intuition about the execution of a timed system is that visible actions 
occur at points in time, and that time passes "continuously" between these points. These 
observations lead to the definition of a timed execution. The definition is close to the notion of 
hybrid computation of [MMP91] where continuous changes and discrete events alternate during 
the execution of a system. 

A timed execution fragment X of a timed automaton A is a (finite or infinite) sequence of 
alternating A-trajectories and actions in vis(A) U int(A), starting in a trajectory and, if the 
sequence is finite, ending in a trajectory 

X = tjj aitjJia 2 tjJ2 • • • 
such that the following holds for each index i: 

1. If LOi is not the last trajectory in X, then its domain is a closed interval. If u, is the last 
trajectory of X (when X is a hnite sequence), then its domain is a left-closed interval 
(and either open or closed to the right). 

2. If LOi is n °t the last trajectory of X, then (Istate(uji) , a i+ i, fstate(uj i+ i)) £ steps(A). 

A timed execution is a timed execution fragment uj aiUJia 2 ijJ2 • • • for which fstate(uj ) is a start 
state. 

If X is a timed execution fragment, then dehne ftime(T,) and fstate(T,) to be ftime(uj ) and 
fstate(uj ), respectively, where uj is the hrst trajectory of X. Also, dehne ltime(T,) to be the 
supremum of the union of the domains of the trajectories of X, i.e. the supremum of the now 
values of all the states in the ranges of the trajectories of X. Finally, if X is a hnite sequence 
where the domain of the last trajectory uj is a closed interval, dehne lstate(T,) to be Istate(uj). 

Finite, Admissible, and Zeno Timed Executions 

The timed executions and timed execution fragments of a timed automaton can be partitioned 
into finite, admissible, and Zeno timed executions and timed execution fragments. 
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A timed execution (fragment) S is defined to be finite, if it is a finite sequence and the 
domain of the last trajectory is a closed interval. A timed execution (fragment) S is admissible 
if Itime(Yi) = oo. Finally, a timed execution (fragment) S is Zeno if it is neither finite nor 
admissible. 

There are basically two types of Zeno timed executions: those containing infinitely many 
occurrences of non-time-passage actions but for which there is a finite upper bound on the 
times in the domains of the trajectories, and those containing finitely many occurrences of 
non-time-passage actions and for which the domain of the last trajectory is right-open. Thus, 
Zeno timed executions represent executions of a timed automaton where an infinite amount of 
activity occurs in a bounded period of time. (For the second type of Zeno timed executions, the 
infinitely many time-passage steps needed to span the right-open interval should be thought 
of as an "infinite amount of activity".) 

There are idealized processes that naturally exhibit Zeno behaviors. As an example consider 
a bah that bounces on the floor and loses a fraction of its energy at each bounce. Ideally the 
ball will bounce infinitely many times within a finite amount of time. Note, however, that 
our timed automaton model cannot suitably describe this process since there is no way of 
specifying what happens after the ball stops bouncing. Fortunately, Zeno behaviors do not 
occur in the systems we are interested in describing. 

From now on, the focus will be on admissible timed executions since these executions 
correspond to the intuition that time is a force beyond control that happens to approach 
infinity. However, according to the definition of timed automata, it is possible to specify timed 
automata for which from some states no admissible timed executions fragments are possible. 
In particular, such a state may only allow a Zeno timed execution, or it may prevent time from 
advancing at all (in which case a time deadlock has occurred). 

Denote by t-frag*(A), t-frag™ (A) , t-frag (A), and t-frag(A) the sets of finite, admissible, 
Zeno, and all timed execution fragments of A. Similarly, denote by t-exec*(A), t-exec°°(A), 
t-exec z (A), and t-exec(A) the sets of finite, admissible, Zeno, and all timed executions of A. 

A finite timed execution fragment Si = cj ai^i • • • fl„w„ of A and a timed execution fragment 
S 2 = oj' n a n+ iOJ n+ ia n+ 2ijj n+ 2 ■ ■ ■ of A can be concatenated if lstate(T,i) = fstate(T, 2 ). The con- 
catenation, written Si ~ S 2 , is defined to be S = oj aiOJi ■ ■ ■ a n (uj n ~ u' n )a n+ iU n+ ia n+ 2U n +2 • • •, 
where uj" uj'(t), for any functions uj and u' from intervals of time to states(A), is defined to be 
tjj(t) if t is in dom(uj), and u'(t) if t is in dom(uj') \ dom(uj). It is easy to see that S is a timed 
execution fragment of A. 

The notion of timed prefix, called t-prefix, for timed execution fragments is defined as 
follows. A timed execution fragment Si of A is a t-prefix of a timed execution fragment S 2 
of A, written Si < t S 2 , if either Si = S 2 or Si is finite and there exists a timed execution 
fragment S' : of A such that S 2 = Si ~ S^. Likewise, Si is a t-suffix of S 2 if there exists a finite 
timed execution fragment S' : such that S 2 = S' : ~ Si. 

For a finite timed execution fragment Si and a timed execution fragment S 2 with Si < t S 2 , 
define S 2 — Si to be the (unique) timed execution fragment S' : such that S 2 = Si ~ S' r 

The length of a timed execution fragment S expresses the number of visible and internal 
actions in S. Thus, even though S is admissible or Zeno (and thus not finite), its length might 
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be finite. Formally, define the length of S = uj aiUJia 2 ijJ2 • • • as 

. . a J n if S is a finite sequence and ends in u> n 
1 oo if S is an infinite sequence 

The definition of ith prefix of S = (jj ai(jJia 2 u 2 • • •, f° r all < i < |S|, is 

Y,\i = l> ci 1 l> 1 ■ --aiUi 

Define Sot, read "S before t", for all t > /tirae(S), to be the t-prefix of S that includes 
exactly all states with times not bigger than t. Formally, 



Sot 



S if t > Itime(Yi) 

S' if t < /tirae(S) and there exists S" = lo'Io!{lo'{ ■ ■ ■ such that 
S = S' ~ S" and /tirae(S) = t and |dom(u;o)| > 1 



Likewise, define Sot, read "S after t", for all t < /time(S) or all t < /time(S) when S is finite, 
to be the t- suffix of S that includes exactly all states with times not smaller than t. Formally, 



Sot 



Timed Traces 



S if t < /time(S) 

S' if t > /tirae(S) and there exists S" = lo'^o!{lo'{ ■ ■ -u'^ such that 
S = S" ~ S' and /time(S') = t and \dom(uZ)\ > 1 



In the untimed model automata are compared based on their traces. This turns out to be 
inadequate in the timed model as the following example illustrates. The example is a slight 
modification of an example in [LV91]. 

Example 4.2 

Let Idle be a timed automaton that lets time pass except that it performs a visible action a at 
time 50. More specifically, let the state set be T X {true, false} with the initial state (0, true), 
and let the steps be 

((t, b), v, (f, b)) if t < t' A (b = true => t 1 < 50), and 
((50, true), a, (50, false)). 

Then let idle be the timed automaton that performs a at time 50 but also performs an 
internal action r at time 37. Thus, the state space is T X {true, false} X {true , false} , initially 
(0, true, true), and let the steps be 

((t, 6 l5 b 2 ), v, (f, b x , b 2 )) if t < t' A (&i = true => t' < 37) A (b 2 = true => t' < 50), 
((37, true, true), t, (37, false, true)), and 
((50, false, true), a, (50, false, false)). 

Then 7<i/e and 7<i/e do not have the same traces. In particular, Idle has a trace v a that is 
not a trace for 7<i/e'. (Idle has a trace z/z/a since it cannot let time pass to 50 in one step.) 
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This clearly contradicts the intuition about timed automata. Seen from "the outside" they 
both wait until time 50 and then perform a. The example explains why traces are not a good 
basis for comparing timed automata. 

Note, that making v internal would not solve the problem. In that case, a timed automaton 
that performs a at time 10 would have the same traces (namely a) as a timed automaton that 
performs a at time 50. ■ 

The problem in Example 4.2 arises because of the invisible nature of time-passage actions. 
This leads to timed traces, which consist of the visible actions together with their time of 
occurrence. 

Timed Sequence Pairs 

A timed sequence over a set K is defined to be a (finite or infinite) sequence 8 over K X T in 
which the second components of every pair (the time components) are nondecreasing. Define 
8 to be Zeno if it is infinite and the limit of the time components is finite. For any nonempty 
timed sequence 8, define ftime(S) to be the time component of the first pair in 8. 

As for timed execution fragments, the operators o and o are defined on timed sequences. 
Define Sot, for all t G T, to be the longest prefix 8' of 8 such that all time components of 8' 
are less than or equal to t. Similarly, define Sot, for all t G T, to be the longest suffix 1 8' such 
that all time components of 8' are greater than or equal to t. 

A timed sequence pair over K is a pair 7 = (S,t), where 8 is a timed sequence over K and 
t G T U {00}, such that t is greater than or equal to all time components in 8. Let seq(j) 
and Itime(j) denote the two respective components of 7. Then define ftime(j) to be equal 
ftime(seq("f)) in case seq(j) is nonempty, and equal to Itime(j) otherwise. Denote by tsp(K) 
the set of timed sequence pairs over K . A timed sequence pair 7 is said to be finite if both 
seq(j) and Itime(j) are finite, and admissible if seq(j) is not Zeno and Itime(j) = 00. 

Timed Traces of Timed Automata 

Let X = tjj aitjJia 2 tjJ2 • • • be a timed execution fragment of a timed automaton A. For each 
a,, define the time of occurrence i, to be ltime(Lo i _ 1 ), or equivalently, ftime(uji). Then, define 
t-seq(T,) to be the sequence consisting of the actions in S paired with their time of occurrence: 

t-seq(Y,) = {a 1 ,t 1 )(a 2 ,t 2 ) ■ ■ ■ 

Then t-trace(T,), the timed trace of S, is defined to be the timed sequence pair over vis (A) 

t-trace(E) = (f-seg(S) \ (vis(A) X T), Ifime(S)). 

Thus, t-trace(T,) records the occurrences of visible actions together with their time of occur- 
rence, and the limit time of the timed execution fragment. A timed trace suppresses both 
internal and time-passage actions. 



1 Strictly speaking, the suffix obtained by removing the shortest prefix. 
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Let t-traces* (A) , t-traces 00 (A) , t-traces z (A), and t-traces(A) denote the sets of timed traces 
of A obtained from finite, admissible, Zeno, and all timed executions of A, respectively. 

Relationships Between Timed and Untimed Execution Fragments 

There is a close relationship between timed execution fragments and ordinary execution frag- 
ments of a timed automaton. This leads to an alternative, but equivalent, definition of timed 
traces. All definitions and lemmas are taken from [LV93b]. 

Sampling 

Roughly speaking, an (ordinary) execution fragment can be regarded as "sampling" the state 
information in a timed execution fragment at a countable number of points in time. Formally, 
we say that an execution fragment a = s ais 1 a 2 s 2 • • • of A samples a timed execution fragment 
X = tjj bitjJib 2 tjJ2 ■ ■ ■ of A if there is a monotone increasing function / : N — ► N such that the 
following conditions are satisfied. 

1. /(0) = 0, 

2. bi = aj(i) for all i > 1, 

3. (ij = v for all j not in the range of /, 

4. For all i > such that u, is not the last trajectory in X, 

(a) Sj e rng(iOi) for all j, f(i) < j < f(i + 1), 

(b) Sjaynow = ftime(uji), and 

(c) Sf( i+ i^_i.now = Itime(uji). 

5. If LOi is the last trajectory in S, then 

(a) Sj e rng(iOi) for all j, f(i) < j, 

(b) Sjaynow = ftime(uji), and 

(c) sup{sj.now | f(i) < j} = Itime(uji). 

In other words, the function / in this definition maps the (indices of) actions in S to corre- 
sponding (indices of) actions in a, in such a way that exactly the non-time-passage actions 
of a are included in the image. Condition 4 is a consistency condition relating the first and 
last times for each non-final trajectory to the times produced by the appropriate steps of a. 
Condition 5 gives a similar consistency condition for the first time of the final trajectory (if 
any); in place of the consistency condition for the last time, there is a "cofinality" condition 
asserting that the times grow to the same limit in both executions. 

The following two straightforward lemmas show the relationship between timed execution 
fragments and ordinary execution fragments. 
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Lemma 4.3 

Let A be a timed automaton. If a is an execution fragment of A, then there is a timed 
execution fragment X of A such that a samples X. ■ 

Lemma 4.4 

Let A be a timed automaton. If X is a timed execution fragment of A, then there is an 
execution fragment a of A such that a samples X. ■ 

Define a state s to be t-reachable in timed automaton A provided that there is a finite timed 
execution X such that lstate(T,) = s. The following lemma shows that t-reachability can 
equivalently be defined by means of ordinary executions. 

Lemma 4.5 

State s is t-reachable in A iff it is reachable in A. 

Proof. Straightforward using Lemmas 4.3 and 4.4. ■ 

An important consequence of Lemma 4.5 is that any technique that can prove that a property 
holds for all final states of finite (ordinary) executions is a sound technique for proving that 
a property holds in all t-reachable states of a timed automaton. Most importantly, induction 
on the steps of ordinary executions is sound in this sense. Conversely, any technique that can 
prove that a property holds for all t-reachable states also proves that it holds for all reachable 
states. 

Finite, Admissible and Zeno Execution Fragments 

An execution fragment a is finite if it is a finite sequence. Ln the timed model, an execution 
fragment a is defined to be admissible if there is no finite upper bound on the now values of 
the states in a. Finally, an execution fragment is said to be Zeno if it is neither finite nor 
admissible. 

Lemma 4.6 

If a samples X then 

1. a is finite iff X is finite, 

2. a is admissible iff X is admissible, and 

3. a is Zeno iff X is Zeno. ■ 
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Timed Traces 

It is possible to give a sensible definition of the timed trace of an ordinary execution fragment 
of a timed automaton. Namely, suppose a = s ais 1 a 2 s 2 • • • is a execution fragment of a timed 
automaton A. First, define Itime(a) to be the supremum of the now values of all the states 
in a. Then let 8 be the sequence consisting of the actions in a paired with their times of 
occurrence: 

8 = (a l7 Si.now)(a 2 , s 2 .now) 

Then t-trace(a), the timed trace of a, is defined to be the pair 

t-trace(a) = (8 \ (vis(A) X T), Itime(a)) 

The following lemma shows that the definitions of timed traces for execution fragments and 
timed execution fragments are properly related: 

Lemma 4.7 

If a samples X then t-trace(a) = t-trace(T,) . ■ 

4.2 Live Timed Automata 

The notion of live timed automaton is now introduced. The definition is similar to the definition 
of a live automaton in the untimed model (Definition 3.2) except for the fact that the liveness 
condition is a set of timed executions. 

Definition 4.8 (Live timed automaton) 

A timed liveness condition L for a timed automaton A is a subset of the timed executions of 
A such that any finite timed execution of A has an extension in L. Formally, L C t-exec(A) 
such that for all X G t-exec* (A) there exists a £' £ t-frag(A), such that S " S' 6 X. 

A live timed automaton is a pair (A,L), where A is a timed automaton and L is a timed 
liveness condition for A. The timed executions of L are called the live timed executions of A. 



4.3 Safe Timed I/O Automata 

Definition 4.9 (Safe timed I/O automaton) 

A safe timed I/O automaton is a timed automaton augmented with a visible action signature, 
vsig(A) = (in(A), out (A)), which partitions vis(A) into input and output actions. A must be 
input- enabled. 

The internal and output actions of a safe timed I/O automaton A are referred to as the 
locally- controlled actions of A, written local(A). Thus, local(A) = int(A) U out(A). ■ 
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Parallel composition of safe timed I/O automata is defined similarly to the corresponding 
definition for the untimed model (Definition 3.4). However, the time-passage steps and the 
now mappings of the component safe timed I/O automata need special treatment. Specifically, 
time is only allowed to pass by a certain amount in the composition if all components allow 
the same amount of time to pass. Also, the state space of the composition consists of all states 
in the cartesian product of the component state spaces where the component states have the 
same now values. Thus, the components must agree on the time. The now mapping of the 
composition is then defined to be the now mapping of any of the components. 

Definition 4.10 (Parallel composition) 

Safe timed I/O automata Ai, . . .,A N are compatible if for all 1 < i,j ' < N with i ^ j, the 
following conditions hold: 

1. out(Ai) n out(Aj) = 

2. int(Ai) n acts(Aj) = 

The parallel composition Ai\\ ■ ■ ■ \\A N of compatible safe timed I/O automata Ai, . . .,A N is the 
safe timed I/O automaton A such that 

1. states(A) = {(si, . . . , s N ) G states(Ai) X • • • X states(A N ) \ Si.now Al = • • • = s N .now AN } 

2. start(A) = start(Ai) X • • • X start{A N ) 

3. (si, . . . , s N ).now A = s 1 .now Al (= s 2 .now M = • • • = s N .now AN ) 

4. out(A) = out(A 1 ) U • • • U out(A N ) 

5. in(A) = (m(Ai) U • • • U in(A N )) \ out {A) 

6. int(A) = mf(Ai) U • • • U int(A N ) 

7. ((«i, • • • , Sjv), a, (s[, . . . ,s' N )) G steps(A) iff for all 1 < i < N 

(a) if a G acts(Ai) then (s,, a, s'.) G steps(Ai) 

(b) if a £ acts(Ai) then s, = s'- ■ 

Note, how Condition 7 of the definition captures both time-passage steps (where all components 
participate) and other steps (where a subset of the components participate). 

Lemma 3.5 carries over to the timed case. However, a new definition of projection is needed 
for timed executions. Specifically, let A = Ai\\ ■ ■ ■ \\A N . For any function uj from an interval 
of time to states(A), define u\Ai to be obtained from uj by projecting every state in the range 
of uj to A,. Let S = uj aiUJia2UJ2 • • • be an alternating sequence of functions from intervals of 
time to states(A) and actions from acts(A) \ {z/} such that S does not end in an action if it is 
a finite sequence. Then the projection S \A, of S onto A, is obtained by projecting each uj k of 
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X onto A,, removing each action cij that is not an action of A,, and concatenating each pair of 
(projected) functions uj k , oj k+ i whose interleaved action is removed. 

The following lemma relates the timed executions of a composed timed automaton with 
those of the component timed automata. 

Lemma 4.11 

Let A = Ai\\ ■ ■ ■ \\A N . Let X = uj aiUJia 2 ijJ2 • • • be an alternating sequence of functions from 
intervals of time to states(A) and actions from acts (A) \ {//} such that X does not end in an 
action if it is a finite sequence, the domain of each function ujj that is not the last function of X 
is closed, and, if X is a finite sequence, the domain of the last function of X is left closed. Let 
consistent(T,) be the predicate that is true iff for each A, and each j such that a,j G' acts(Ai), 
Istate (ujj _ i ) \Ai = f state (ujj ) [A; . Then, 

1. consistent(T,) and T,\Ai £ t-exec*(Ai), for all A i} iff S G t-exec*(A). 

2. consistent(T,) and T,\Ai £ t-exec^iAi), for all A i} iff S G f-ea;ec 00 (A). 

3. consistent(T,) and T,\Ai £ t-exec z (Ai), for all A i} iff S G t-exec z (A). 
4- consistent(T,) and T,\Ai £ t-exec(Ai), for all A i} iff S G t-exec(A). 

If S G t-exec(A) then, for all i, ltime(T,) = ltime(T,\Ai). ■ 

We now turn attention to the timed versions of action hiding and action renaming. The only 
changes from the untimed model are the handling of the now component and the fact that the 
time-passage action, is, may not be renamed. 

Definition 4.12 (Action hiding) 

Let A be a safe timed I/O automaton and let A be a set of actions such that A C local(A). 
Then define A \ A to be the safe timed I/O automaton such that 

1. states(A \ A) = states(A) 

2. start(A \ A) = start(A) 

3. now A \ A = now a 

4. in(A \ A) = in(A) 

5. out(A\ A) = out(A) \ A 

6. mf (A \ A) = mf (A) U A 

7. steps(A \ A) = steps(A) ■ 
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Lemma 4.13 

Let A be a safe timed I/O automaton and let A be a set of actions such that A C local(A). 
Then 

1. t-exec*(A \ A) = t-exec*(A) 

2. t-exec°°(A \ A) = t-exec°°(A) 

3. t-exec z (A\A) = t-exec z (A) 

4- t-exec(A \ A) = t-exec(A) ■ 

Definition 4.14 (Action renaming) 

A mapping p from actions to actions is applicable to a safe timed I/O automaton A if it is 
injective, acts(A) C dom(p), and p(v) = v. Given a safe timed I/O automaton and a mapping 
p applicable to A, define p(A) to be the safe timed I/O automaton such that 

1. states(p(A)) = states(A) 

2. start(p(A)) = start(A) 

3. now p ( A ) = now A 

4. in(p(A)) = p(in(A)) 

5. out(p(A)) = p(out(A)) 

6. int(p(A)) = p(int(A)) 

7. steps(p(A)) = {(s,p(a),s r ) \ (s,a,s r ) £ steps(A)} ■ 

Lemma 4.15 

Let A be a safe timed I/O automaton and p be a mapping applicable to A. For any timed 
execution S of A, let p(T,) denote the sequence obtained by replacing each occurrence of every 
action a in S by p(a), and for any set L of timed executions of A, let p{L) = {/o(S) | S G L}. 
Then 

1. t-exec*(p(A)) = p(t-exec*(A)) 

2. t-exec°°(p(Aj) = p{t-exec°° (A)) 

3. t-exec z (p(A)) = p(t-exec z (A)) 

4- t-exec(p(A)) = p(t-exec(A)) ■ 
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4.4 Live Timed I/O Automata 

In order to define live timed I/O automata, the notion of environment-freedom is generalized 
to timed systems. As for the untimed model a live timed I/O automaton is environment-free 
if it can behave properly independently of the behavior of the environment. Specifically, a 
game is set up between a timed automaton and its environment and the timed automaton is 
environment-free iff it has a winning strategy against its environment. 

The notion of strategy is similar to the one used for the untimed model. However, the 
presence of time has a strong impact on the type of interactions that can occur between a 
timed automaton and its environment. 

In the untimed model the environment is allowed to provide any finite number of input 
actions at each move, and the system is allowed to perform at most one of its locally-controlled 
actions at each move. Thus, the fact that the environment can be arbitrarily fast with respect 
to the system, but not infinitely fast, is reflected in the structure of the environment moves. 
This structure is not needed in the timed model since actions in the timed model are associated 
with specific times. In particular, the relative speeds of the system and the environment are 
given directly by their timing constraints. The behavior of the environment during the game 
can be represented simply as a timed sequence over input actions. 

In the untimed model a strategy is not allowed to base its decisions on any future input 
actions from the environment. In the timed model, not only is the strategy not allowed to 
know about the occurrence of future input actions, but the strategy is also not allowed to 
know anything about the timing of such input actions, e.g., that no inputs will arrive in the 
next e time units. Thus, if a strategy in the timed model decides to let time pass, it is required 
to specify explicitly all intermediate states. By specifying all states at intermediate times for a 
time-passage step, the current state of the system will always be known should the time-passage 
step be interrupted by an input action. 

As in the untimed model, a strategy in the timed model is a pair of function (g, f). Function 
/ takes a finite timed execution and decides how the system behaves till its next locally- 
controlled action under the assumption that no input are received in the meantime; function 
g decides what state to reach whenever some input is received. 

Definition 4.16 (Strategy) 

Consider any safe timed I/O automaton A. A strategy defined on A is a pair of functions 
(g,f) where g : t-exec*(A) X in(A) — ► states(A) and / : t-exec*(A) —^ (traj(A) X local(A) X 
states(A)) U traj(A), where traj(A) denotes the set of A-trajectories, such that 

1. g(Yi,a) = s implies T,a{s} £ t-exec*(A) 

2. /(£) = (u, a, s) implies X ~ uja{s} £ t-exec* (A) 

3. /(£) = u implies S ~ u £ t-exec°°{A) 

4. / is consistent, i.e., if /(£) = (u,a,s), then, for each t, ftime(uj) < t < Itime(uj), 
/(£ "(wo f)) = (wof, a, s), and, if /(£) = u, then, for each t, ftime(uj) < t < Itime(uj), 
/(£~ (u of)) = ujot. 
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t^ -i • in ,v^\ • I u if /(E) = ( w ? a ? s ) 

h or not ational convenience define t(\).tri = < .<.,),-,( 

JV ; u if /(E) = w 



Condition 1 of Definition 4.16 states that g returns a "legal" next state given an input. Con- 
ditions 2 and 3 state the two possible system moves given by /: either / specifies time-passage 
followed by a local step, or / specifies that the system simply lets time pass forever. Note 
that / specifies all states during time passage. The consistency condition (Condition 4) for / 
says that, whenever after a finite timed execution E the system decides to behave according to 
oja{s} or u, after performing a part of uj the system would decide to behave according to the 
rest of ojci{s} or uj. In other words, a strategy decision cannot change in the absence of some 
inputs. The consistency condition is required for the closure of the composition operator. 

The game between the system and the environment works as follows. The environment can 
provide any input at any time, while the system lets time pass and provides locally-controlled 
actions based on its strategy. It is very important for the system moves not to be based on the 
future moves of the environment. Specifically, at any point in time the system decides its next 
move using function /. If an input comes, the system will perform its current step just until 
the time at which the input occurs, and then use function g to compute the state reached as 
a result of the input. 

A new problem arises when the system decides to perform an action at the same time 
at which the environment is providing some input. Our model does not rule out such race 
conditions. Practical examples of such situations arise whenever the system has some timeout 
mechanism and the input occurs exactly when the timeout period expires. The race conditions 
are modeled as nondeterministic choices. As a consequence, the outcome, i.e., the result of the 
game, for a timed strategy is a set of timed executions. 

The following definition of the outcome of a strategy for safe timed I/O automata closely 
parallels the corresponding definition in the untimed model. 

Definition 4.17 (Outcome of a strategy) 

Let A be a safe timed I/O automaton and (g,f) a strategy defined on A. Define a timed 
environment sequence for A to be a timed sequence over in(A), and define a timed environment 
sequence X for A to be compatible with a timed execution fragment E of A if either X is 
empty, or E is finite and ltime(T,) < ftime(X). Then define R( g j), the next-relation induced by 
(g,f), as follows: for any E,E' £ t-exec(A) and any 1,1' compatible with S,E', respectively, 

((s,i),(E',i'))e i^ iff 
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(X ~ wa{s},I) where X is finite, I = e, /(£) = (u, a, s), 
(X ~ w,I) where X is finite, I = e, /(E) = a;, 



(X',I') = 



(X ~ wa{s},I) where X is finite, X = (b,t)X", /(X) = (a;, a, s), 

Itime(uj) < t, 

(X ~ a/a{s'},Z") where X is finite, I = (a,t)X", f(T,).trj = u, 

Itime(uj) > t, oj' = oj o i, g(E ^ a;', a) = s', or 



I (S,!) 



where S is not finite. 



Let S be a finite timed execution of A, and I be a timed environment sequence for A compatible 
with S. 

An outcome sequence of (g,f) given S an<i lis an infinite sequence (S n ,I n ) n>0 that satisfies: 

• (E°,I°) = (E,I) and 

• for all n > 0, ((E"" 1 ,!"- 1 ), (S n ,I n )) G R (gJ) . 
Note, that (S n ) n>0 forms a chain ordered by t-prefix. 

The outcome (9( 3 j)(S,I) of the strategy (g,f) given S and I is the set of timed executions 
£' for which there exists an outcome sequence (S n ,I n ) n>0 of (g,f) given S and I such that 

S^lim^S". " ■ 

The set of outcome sequences of (g,f) given some S and I is determined step by step using 
the next-relation Rr q t). In the definition of Rr q t), the first, second, and third cases deal with 



different situations in which no input occurs during the system move chosen by /. The fourth 
case takes care of the situation in which inputs do occur during the system move chosen by /. 
Note, that the third and fourth cases may both be applicable whenever the next input action 
of I and the local action chosen by / occur at the same time. This is why the outcome is a 
set of timed executions. Finally, the fifth case is needed for technical convenience, since the 
second case generates an admissible timed execution. 

The following lemma states that an outcome set is never empty and that an element of 
an outcome cannot be finite. Furthermore, if an element of an outcome is Zeno, it contains 
infinitely many actions (other than the implicit time-passage actions). 

Lemma 4.18 

Let A be a safe timed I/O automaton, (g, f) a strategy defined on A, S a finite timed execution 
of A, and J a timed environment sequence for A compatible with S. Then (9( 3 j)(S,I) 7^ 
and C (3i/) (S,I) C (t-exec°°(A) U t-exec z (A)). Furthermore, if YJ G C (3i/) (S,I) and £' G 
t-exec z (A), then |S' \ acts(A)\ = 00. 
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Proof. Let R( g j) be the next-relation induced by (g,f). Construct an outcome sequence 
of (g,f) given X and X inductively as follows. Define (X°,Z°) = (S,I). For any n > 0, 
assume (X n_1 ,Z n_1 ) has been defined. Then it is easy to see that the condition of at least 
one case in the definition of R( g j) is satisfied. Thus, define (X n ,Z n ) to be any pair such that 
((X n_1 ,Z n_1 ), (X n ,Z n )) G R( g j)- This inductively defined outcome sequence gives rise to an 
element in (9( 3 j)(X,Z). That proves that (9( 3 j)(X,Z) is not empty. 

Now, let (S n ,I n ) be an arbitrary outcome sequence of (g, /) given X and X. Clearly, S° = X G 
t-exec(A). Now assume, that S n G t-exec(A). Then, by the four conditions of Definition 4.16, 
it is easy to see that also S n+1 G t-exec(A). Thus, by induction, S n G t-exec(A) for all n > 0. 
Now, assume £' = lim n ^oo(S n ) ^ t-exec(A). Then there must be a finite t-prefix X" of X' such 
that X" ^ t-exec*(A). Also, X" must be a t-prefix of X n for some n. However, this contradicts 
the fact that X n G t-exec(A). Thus, X' G t-exec(A). 

Now, assume that X' is finite. Then there exists a number n' such that for all n > n' , X n = 
X n_1 = X', but this contradicts the definition of R( g j)- Thus, (9( 3 j)(X,Z) C (t-exec 00 (A) U 
t-exec z (A)) 

Finally, it is easy to see that if £' G t-exec z (A), then £' is an infinite sequence of trajectories 
and actions. Only the second case in the definition of R( g j) can lead to a finite sequence, but 
in this case the outcome will be admissible (cf. Definition 4.16 Condition 3). This proves the 
final part of the lemma. ■ 

Another problem due to the explicit presence of time in the model is the capability of a system 
to block time. Under the reasonable assumption that it is natural for a system to require that 
time advances forever, a timed automaton that blocks time cannot be environment-free. Thus, 
we could assume that finite and Zeno timed executions are not live and that the environment 
cannot block time. However, as is illustrated in the following example due to Lamport, Zeno 
timed executions cannot be ignored completely. 

Example 4.19 

Consider two safe timed I/O automata A,B such that in(A) = out(B) = {b} and out(A) = 
in(B) = {a}. Let A start by performing its output action a and let B start by waiting for 
some input. Furthermore, let both A and B reply to their ra th input with an output action 
exactly l/2 n time units after the input has occurred. 

Consider the following definition of environment-freedom, which assumes that the environ- 
ment does not behave in a Zeno manner: a pair (A, L) is environment-free iff there exists a 
strategy (g, /) defined on A such that for each finite timed execution S of A and any admissible 
timed environment sequence X for A compatible with S we have (9( 3 j)(S,I) C L. Then it is 
easy to observe that, if L A and L B are defined to be the set of admissible timed executions 
of A and B, respectively, the pairs (A,L A ) and (B,L B ) are environment-free. However, the 
parallel composition of A and B yields no admissible executions, rather it only yields a Zeno 
timed execution, which blocks time. Thus, the parallel composition of (A,L A ) and (B,L B ) 
constrains the environment. Observe that (A,L A ) and (B,L B ) "unintentionally" collaborate 
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to generate a Zeno timed execution: each pair looks like a Zeno environment to the other. ■ 

To eliminate the problem of Example 4.19 one must ensure that a system does not collaborate 
with its environment to generate a Zeno timed execution. We call Zeno-tolerant those timed 
executions where such a collaboration does not arise. 

Definition 4.20 (Special types of timed executions) 

Given a safe timed I/O automaton A, and given a timed execution X of A, 

• X is said to be environment- Zeno if X is a Zeno timed execution that contains infinitely 
many input actions; 

• X is said to be system-Zeno if X is a Zeno timed execution that either contains infinitely 
many locally-controlled actions or contains finitely many actions; 

• X is said to be Zeno-tolerant if it is an environment-Zeno, non-system-Zeno timed exe- 
cution; equivalently, X is Zeno-tolerant if 

1. Itime(Yi) is finite, 

2. X contains infinitely many input actions, and 

3. X contains finitely many locally-controlled actions. 

Denote by t-exec zt (A) the set of Zeno-tolerant timed executions of A. ■ 

A Zeno-tolerant strategy guarantees that the system never chooses to block time in order to 
win its game against the environment. That is, a Zeno-tolerant strategy produces Zeno timed 
executions only when applied to a Zeno timed environment sequence I, and in these cases the 
outcome is Zeno-tolerant. Thus, the system does not respond to Zeno inputs by behaving in a 
Zeno fashion. 

Definition 4.21 (Zeno-tolerant strategy) 

A strategy (g,f) defined on a safe timed I/O automaton A is said to be Zeno-tolerant if, for 
every finite timed execution X G t-exec* (A) and every timed environment sequence X for A 
compatible with X, (gJ) (^,X) C t-exec°°(A) U t-exec zt (A). ■ 

Now the definition of environment-freedom for the timed model is possible. 

Definition 4.22 (Environment-freedom) 

A pair (A, L) where A is a safe timed I/O automaton and L C t-exec(A) is environment-free iff 
there exists a Zeno-tolerant strategy (g, /) defined on A such that for each finite timed execution 
X of A and each timed environment sequence X for A compatible with X, (9( 3 j)(X,Z) C L. 
The pair (g,f) is called an environment-free strategy for (A,L). ■ 
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A pair (A,L) is environment-free if, after any finite timed execution and with any (Zeno 
or non-Zeno) sequence of input actions, it can generate some admissible or Zeno-tolerant 
timed execution in A. Also, A must never generate one of its finite or system-Zeno timed 
executions, since it would constrain its environment in this case. Thus liveness conditions 
should not include any finite or system-Zeno timed execution. Zeno-tolerant timed executions 
are used only to handle illegal interactions, and therefore also should not be included in liveness 
conditions. This leads to the definition of live timed I/O automata, where the liveness condition 
contains only admissible timed executions, but the strategy is allowed to yield Zeno-tolerant 
outcomes when given a Zeno timed environment sequence. 

Definition 4.23 (Live timed I/O automaton) 

A live timed I/O automaton is a pair (A,L), where A is a safe timed I/O automaton and 
L C t-exec co (A), such that the pair (A, L U t-exec zt (A)) is environment-free. ■ 

Lemma 4.24 

If(A,L) is a live timed I/O automaton, then L is a timed liveness condition for A. 

Proof. Given a finite timed execution X of A, consider an environment-free strategy (g,f) 
for (A,L U t-exec zt (A)). Consider any timed execution X ~ £' G (9( 3 j)(£,e). Such a timed 
execution exists according to Lemma 4.18. The timed execution X ~ £' is not Zeno-tolerant 
since it contains finitely many input actions. Therefore X ~ X' is a timed execution of L, i.e., 
X can be extended to a timed execution of L. ■ 

As in the untimed model, the parallel composition, action hiding, and action renaming opera- 
tors defined for safe timed I/O automata are extended to live timed I/O automata. 

Definition 4.25 (Parallel composition) 

Live timed I/O automata (Ai, Li), . . ., (A N , L N ) are compatible iff the safe timed I/O automata 
Ai, . . . , A N are compatible. 

The parallel composition (Ai, Li)\\ ■ ■ ■ \\(A N , L N ) of compatible live timed I/O automata 

(Ai, Li), . . . , (A N , L N ) is defined to be the pair (A, L) where A = Ai\\ ■ ■ ■ \\A N and £ = {S 6 
t-exec(A) \ T,\A X G L 1 ,...,T,\A N G L N }. ■ 

The restriction of the parallel composition operator to finitely many components can now be 
justified with the following example. 

Example 4.26 

Let {(Ai,Li)}i> be a family of infinitely many live timed I/O automata such that each safe 
I/O automaton A, has a unique distinct output action a, which executes at time 1, and Li 
is the set of admissible executions of A;. The parallel composition \\ i>0 (Ai,Li) exhibits finite 
or Zeno timed executions only since it can never reach a time greater than 1. Specifically, 
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infinitely many actions, i.e., the set {aj}j>o, must be executed at time 1. Thus \\ i>0 (Ai,Li) 
cannot be an environment-free pair. ■ 

Definition 4.27 (Action Hiding) 

Let (A, L) be a live timed I/O automaton and let A be a set of actions such that A C local(A). 
Then define (A, L)\Ato be the pair (A \ A, L). ■ 

Definition 4.28 (Action Renaming) 

A mapping p from actions to actions is applicable to a five timed I/O automaton (A, L) if it 
is applicable to A. Let X be a timed execution of (A,L). Define p(T,) to be the sequence 
that results from replacing each occurrence of every action a in X by p(a). Given a live 
timed I/O automaton and a mapping p applicable to (A,L), define p((A,L)) to be the pair 

W4{p(s)|sei}). ■ 

As expected, the three operators above are closed for live timed I/O automata in the sense 
that they produce a new live timed I/O automaton. As for the untimed model, this is easy to 
prove for action hiding and renaming, but fairly complicated for parallel composition. 

Proposition 4.29 (Closure of action hiding) 

Let (A, L) be a live timed I/O automaton and let A C local(A). Then (A, L)\A is a live timed 
I/O automaton. 

Proof. Let (A A , L A ) = (A, L) \ A, i.e., (A A , L A ) = (A \ A, L) by Definition 4.27. From Defini- 
tion 4.12 A A is a safe timed I/O automaton. Furthermore, Lemma 4.13 gives t-exec°° (A A ) = 
t-exec^iA). Therefore L A C t-exec°° (A A ) as required by the definition of five timed I/O 
automata (Definition 4.23). 

To show that the pair (A A ,L A U L' A ), where L' A = t-exec zt (A A ), is environment-free, it 
suffices to note that any environment-free strategy for (A,L U L'), where L' = t-exec zt (A), 
is also an environment-free strategy for (A A ,L A U L' A ). In fact the hiding operator simply 
changes some output actions into internal actions. The remaining structure of a live timed 
I/O automaton, including its set of locally- controlled actions, is not affected. ■ 

Proposition 4.30 (Closure of action renaming) 

Let (A,L) be a live timed I/O automaton and let p be a mapping applicable to (A,L). Then 
p((A,L)) is a live timed I/O automaton. 

Proof. Consider any timed execution S of (A,L). Let p(T,) be the sequence obtained by 
replacing each occurrence of every action a in S by p(a). If S is a set of timed executions of 
(A,L),letp(S) = {p(X)\XeS}. 

Let (A P ,L P ) = p((A,L)), i.e., (A P ,L P ) = (p(A),p(L)) by Definition 4.28. From Defini- 
tion 4.14 A p is a safe timed I/O automaton. Furthermore, Lemma 4.15 gives t-exec°°(Ap) = 
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pit-exec 00 (A)). Therefore, since L C t-exec°°(A), L p C t-exec°°(A p ) as required by the defini- 
tion of live timed I/O automata (Definition 4.23). 

Let L' = t-exec zt (A) and let (g, /) be an environment-free strategy for (A, LUL'). Further- 
more, let L' = t-exec zt (A p ). Then Lemma 4.15 and the fact that p maps local(A) to local(A p ) 
and in(A) to in(A p ) implies that L' = p(L'), which in turn implies L p U L' = p(L U L'). Now, 
define a strategy (g p ,f p ) for A p as follows: 

9p(p(^),p(a)) = #(S,a) 

_ f (u,p(a),s') if /(E) = (u,a,s') 
MHM) ~ \ u if /(E) = a; 

It is now trivial to verify that (g p ,f p ) is an environment-free strategy for (A p ,L p U L'). Con- 
sequently, (Apjip) is a live timed I/O automaton. ■ 

As in the untimed model, the proof of closure of the parallel composition operator is consid- 
erably more complicated than the proof of closure for action hiding and action renaming. For 
compatible live timed I/O automata (Ai, Li), . . . , (A N , L N ), let (A, L) denote the parallel com- 
position (Ai,ii)|| • • • \\(A N ,L N ). In order to prove that (A,L) is a live timed I/O automaton 
one must show that (A, L U t-exec zt (A)) is environment-free, which, in turn, requires finding 
an environment-free strategy for (A,L U t-exec zt (A)). 

The proof proceeds by first defining a strategy (g, /) for (A, L) based on a strategy (g,, /) 
for each (Ai,Li U t-exec zt (Ai)), and then proving that (g,f) is an environment-free strategy 
for (A,LU t-exec zt {A)). 

Function g computes, given input a, the next state according to the g, functions of those 
components of A for which a is an input action, and simply leave the state unchanged for 
those components for which a is not an action. Function / determines, using each /, which 
component wishes to execute the next locally-controlled action. Say this is the k th component 
and it wishes to perform action a at time t. Then each component A, evolves based on / up 
to time t. Furthermore, at time t, A k takes a step based on f k and each A, for which a is an 
input action takes a step based on g,. 

Definition 4.31 (Parallel composition of (timed) strategies) 

Let A = Ai\\---\\A N be the parallel composition of compatible safe timed I/O automata 
Ai, . . . , A N , and let (g,, /), for each 1 < i < N, be a strategy defined on A,. 

The parallel composition (gi, fi)\\ ■ ■ ■ IKfi'jv, In) of the strategies (g l7 fi), . . . , (gN, In) is the pair 
of functions (g,f) 

g : t-exec* (A) X in(A) —^ states(A) 

f : t-exec* (A) —> (traj(A) X local(A) X states(A)) U traj(A) 

such that 

gp,a) = s where, for all 1 < i < N, s\A = | ^f^. for a^ ^41) 
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and / is denned as follows: For all 1 < i < N, define uji to be fi(T,\Ai).trj. Pick any k, say 
the smallest, such that ltime(uj k ) = mmi < i <N (ltime(uj i )) . Define uj such that 

r J Wj; if i = k 

1 u>i o ltime(uj k ) if i 7= k 

The definition of /(E) has two cases. 

f. If f k (T,\A k ) = (uj k ,a,s k ) then /(£) = (uj,a,s), 



s k if i = k 

gi((T< ~ uj) \Ai, a) if i 7= k and a G in(Ai) 

lstate(uj)\Ai if i ^ k and a ^ acfo(A 8 ) 



where, for all I < i < N, s\Ai = { 

2. If f k (^\A k ) = uj k then /(E) = w. ■ 

Lemma 4.32 

Le£ Ai, . . . , A N be compatible safe timed I/O automata and let, for each 1 < i < N , (gi, /) be 
a strategy defined on A,. Then (<?i, /i)|| • • • ||(#jv, /v) is a strategy defined on Ai\\ ■ ■ ■ \\A N . 

Proof. Let (g,f) = (g u /JU ■ ■ ■ \\(g N , f N ) and A = A x \\ ■ ■ ■ \\A N . To prove that (g,f) is a 
strategy defined on A, the four conditions of Definition 4.16 must be checked: 

1-3. Conditions 1-3 are trivial to check given the definitions of g and /, and the fact that, for 
all i, (gi, fi) is a strategy defined on A,. 

4. Consider the consistency condition of Definition 4.16. First assume, for an arbitrary 
E G t-exec*(A), that /(S) = (uj, a, s), and let t be an arbitrary time such that ftime(uj) < 
t < Itime(uj). It must be shown that /(E ~ (a; o t)) = (uj o t, a, s). 

Let k be such that f k (T,\A k ) = (uj k ,a,s k ). This k exists by definition of /. Then, 
for all i, either /(E[~Aj) = (uji , a, , s, ) , with Itime(uji) > ltime(uj k ), or /(E[~Aj) = uji, 
with Itime(uji) = oo > ltime(uj k ). For all i, ftime(uji) = ftime(uj k ). Thus, for all i, 
ftime(uji) < t < Itime(uji), so since / is consistent 

MM^^t)) = Mp-iuxWAt) = I ^' ) ' a, "' s<) il^sft) 2 ^ a " Si) 

Since by definition k is the smallest index such that ltime(uj k ) = mmi < i <N (ltime(uj i )) 
and since Itime(uji) = ltime(uji o t), k is the smallest index such that ltime(uj k of) = 
Tami < i <N (ltime(uj i o t)). 

Now, since f k ((T,""(uj<it))\Ai) = ((uj k ot), a,s k ), the definition of/ gives: f(T,"(uj<it)) = 
(uj', a, s'), where uj' \A, = uJiOt = (ujot) \A, which implies that uj' = ujot, and s' is defined 
as follows: s'\A k = s k = s\A { , s'\Ai = &•(((£ ~ (w<t))"w')[Aj,o) = #;((S~ uj)\Ai, a) = 
s\Ai if i 7= k and a G in(Ai), and s'\Ai = lstate((Y<~ (uj ot))~ uj')\ Ai = lstate(T,"uj)\Ai = 
s\Ai if i 7^ k and a ^ acts(Ai). Hence, for all i, s'\Ai = s\Ai, which implies s' = s. 
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Thus, (a/, a, s') = (woi, a, s), which finally gives /(£~(u;oi)) = (woi, a, s), as required. 

In a similar fashion, it can be proved that if for arbitrary X G t-exec*(A), /(£) = a;, then, 
for any ftime(uj) < t < ltime(uj)( = oo), it is the case that /(£ ~ (a; o i)) = (wo i). 

This concludes the proof that (g, /) is a strategy defined on A. ■ 

The following lemma is the key lemma for showing that the strategy of Definition 4.31 is 
environment-free if the component strategies are environment-free. Specifically, up to a tech- 
nical condition, the projection of an outcome of (g,f) onto a component A, is an outcome of 
(gi,fi)- Intuitively this means that even though the composed system uses its composed strat- 
egy to find possible outcomes, up to a technical restriction it still looks to each component as 
if it was using its own component strategy. The one restriction in the generality of the lemma 
stems from the following situation. If the system receives Zeno inputs that are not inputs to the 
ith component, then the ith component observes that time is blocked even though the strategy 
for the ith component lets time pass forever. Thus, if an outcome of the composed system is 
Zeno, then the following lemma only applies to the components that perform infinitely many 
actions in the given outcome. Note that the inputs that the ith component "sees" are either 
inputs to the composed system or inputs from other components of the system. 

Lemma 4.33 

Let Ai, . . . , A N be compatible safe timed I/O automata and let, for each 1 < i < N , (gi, fi) be 
a strategy defined on Ai. Let A = Ai\\ ■ ■ ■ \\A N and (g, /) = (g l7 fi)\\ ■ ■ ■ ||(<7jv, In)- 

Furthermore, let X be an arbitrary finite timed execution of A, J be an arbitrary timed en- 
vironment sequence for A compatible with X, £' be an arbitrary timed execution of 0( g j^(Y,,T), 
and i, with 1 < i < N , be an arbitrary index such that if £' is Zeno then |S' \ acts(Ai)\ = oo. 

Then there exists a timed environment sequence I, for Ai compatible with T,\Ai, such that 

z'\AeO (gtJt) (z\A t ,i t ). 

Proof. Definition 4.10 implies that A is a safe timed I/O automaton. Furthermore, by 
Lemma 4.32, (g,f) is a strategy defined on A. 

Let R( g j) and R( gi j { ) be the next-relations induced by (g, /) and (g,, /,), respectively. Also, 
let (S n ,I n ) n>0 be an outcome sequence of (g,f) given S and I such that £' = lim n ^oo S n . 
Since (S n ) n>0 forms an infinite chain ordered by t-prefix and S° = S, S < t £'. Define 
I,- = t-seq(Yi' — Yi)\(in(Ai)xT). Then either I, is empty or ftime(Ji) > ltime(T,) = ltime(T,\Ai). 
Thus, 2; is compatible with £|"A;. 

Let N — ► N be the signature of a total, nondecreasing mapping m. Define m(n) inductively 
on n such that ra(0) = and either m(n) = m(n — 1) or m(n) = m(n — 1) + 1 (for n > 
0). Simultaneously the induction defines (S?,I?) and, if n > and m(n) = m(n — 1) + 1, 
(Y 1 ™ [n \Ti' a '). Furthermore, the same induction, proves 

PI S n is finite iff £™ (n) is finite. 

P2 ftime(fi(ZT (n) )-trj) < ltime{H n ) < ltime(f i (Y,? ( - n) ).trj) if £™ (n) is finite. 
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P3 S n \Ai — ■} ^ m („) 



E m(„) „ (/.(£»(«)) Jrj - <, Itime^)) if £™ (n) is finite 
X; "^ otherwise 



P4 jm(n) = f £-seg(£' - S n ) f (m(^) X T) if £™ (n) is finite 
1 1 e otherwise 

P5 If n > and m(n) = m(n - 1) + 1 then ((E^""^,^"" 1 ^ (^T^af^)) G %,„/,)• 

Intuitively, (£^,2f) represents an outcome sequence of (g,, fi) given £|"A; and I,, and the 
mapping to associates each S n with the first X] such that S n [A; < t X]. 

Note that all the statements are well-defined. For P3, when X" n ' is finite, the application 
of the o operator is well-defined since (g,, fi) is a strategy defined on A, and statement P2 
applies; for P4, when J]™*-™- 1 j s finite, X' — X n is well-defined since by PI X n is finite, and 
furthermore X n < t X' by definition. These observations are not repeated below. Finally, note 
that P5 is not needed in the induction step. P5 is included in the induction for convenience. 

Base case n = 0: 
Define: ra(0) = 

E m(0) = s o |- A . 
T m(0) _ T 

PI X° = X is finite by definition. Since X™^ ^ = X°|"A;, Lemma 4.11 implies that also X™^ ' 
is finite. 

P2 By PI, X™^ ' is finite. Since X™^ ' = E°|"A; and X° = X, it is necessary to prove that 
ftime(fi(Y<\Ai).trj) < ltime(Y<) < ltime(fi(T,\Ai).trj). From the fact that (g,, fi) is a 
strategy defined on A, and Lemma 4.11 conclude that ftime(fi(T,\Ai).trj) = ltime(Y<), 
and since ftime(fi(T,\Ai).trj) < ltime(fi(T,\Ai).trj), the result follows. 

P3 First note that X™ (0) is finite. As in P2, /^me(/ i (S™ (0) ) .trj) = Zft'me(E°). Thus, X° [A,- = 
E m(o) = E m(o) „ (/.( S ™(°)) Jrj - <, to- rae (S )), as required. 

P4 First note that X™ (0) is finite. Then I™ (0) = I,- = £-seg(X' - X) f (m(A,-) X T) = £-seg(X' - 
X°) [" (in(Ai) X T), as required. 

P5 Vacuously satisfied. 

Inductive step n > 0: 

Assume P1-P5 hold for all k < n. Consider cases: 

Case 1 X n_1 is not finite. 

Since ((S"" 1 ,!"" 1 ), (X n ,I n )) G %,,/) and X"" 1 is not finite (S"" 1 ,!"" 1 ) = (X n ,I n ). 
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Define: m(n) = m(n — 1) + 1 

^m(n) ^m(n — 1) 

-T-m(n) ^7-m(n — 1) 

PI Since Y n = S n_1 and £™ w = Y" n ~ ' the result follows from induction hypothesis 
PI. 

P2 Since Y n = X n_1 , S n is not finite and by PI Y" n ' is not finite. Thus, P2 is vacuously 
satisfied. 

P3 Again, since Y n = Y n ~ l and Y" n ' = Y" n ~ , and none of these timed executions 
are finite (by PI), the result follows from induction hypothesis P3. 

P4 As for P3 the result follows from an induction hypothesis; here P4. 

P5 Since £™^ n_ ' is not finite, the result follows directly from the definition of Yl™ n , 

ksi.fi)- 



-7-m(n) i r, 
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Case 2 S" 1 is finite and Y n is not finite. 

Since ((S"" 1 ,!"" 1 ), (Y n ,l n )) G R (gJ ), Y n ~ l is finite, and Y n ~ l is not finite, by Defini- 
tion 4.17, Y n = Y"- 1 ~ u, where u = /(S n_1 ), and 2 n = l n ~ l = e. 

By induction hypothesis PI, Y" n ~ ' is finite. Thus 

I MYf"^ ~ (MYT^.trj < lUme(Y^))) 
= f i (Yf n - 1) ) o ltime{Y n - 1 ) 

where step 1 follows from definition of (g, /) (Definition 4.31) and the fact that Itime(uj) = 
oo (because (g, /) is a strategy), step 2 follows from induction hypothesis P3, and step 3 
follows from consistency of /, (cf. Condition 4 of Definition 4.16). 

Define: m(n) = m(n — 1) + 1 

v^m(n) v^m(n — 1) ^ r /ym(n-l)\ 

-T-m(n) ^7-m(n — 1) 

PI Neither S n nor Y" n ' are finite. 

P2 Vacuously satisfied. 

P3 Since Y*™ n ' is admissible, prove that Y n \A t = £™^ . In particular 

Y n \A t = (Y^-uj^A, 

I (s-^o-K^) 

A (E m(„-i)^ (/ . (E -(«-i)) <, fo- me (E»-i)))~ ( W |-A,.) 

= S™ (n_1) - (/.-(E^""^) o /iimeCE"- 1 )) ~ (/.-(E^""^) o ltime(Y n - v )) 

5_ y,m(n — l) ^ r /y,m(n — 1) \ 

6 y^rri(n) 

— ^i 
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where steps 1, 2, and 6 are trivial, step 3 follows from induction hypothesis P3, 
step 4 follows from the property of u\Ai proved above, and step 5 follows from the 
definition of the operators o and o. 

P4 First note that £™ n ' is not finite and £™^ n_ ' is finite. Then 

-T-m(n) J_ ^7-m(n — 1) 

= t-seqiY,' - S"" 1 ) \ (m(A,-) X T) 
= t-seqiY," - S"" 1 ) \ (m(A,-) X T) 
= t-seqiu) \ (in(Ai) X T) 

5 

= e 
where steps 1, 4, and 5 are trivial, step 2 follows from induction hypothesis P4, and 
step 3 follows from the fact that S n is admissible and thus a fixpoint in (T, k ) k>0 . 

P5 Since £™ (n-1) is finite, lf n) = z^"" 1 ) = e (by P4), and £™ (n) = S™ (n_1) ~ 
/j(S™ ), the result follows from the second case in the definition of R( gt j t ) (Def- 
inition 4.16). 



Case 3 S"" 1 and S n are finite. 

The definition of R( g j) gives three cases to consider. (The first, third, and fourth cases 
in Definition 4.17.) Consider the first and third cases at the same time. 

Case 3.1 First and third cases. 

From definition of R( g j) note that T," = S n_1 ~ uja{s}, /(S n_1 ) = (uj, a, s), and 

jn-l f £ OT 

[ (b,t)T with Itime(io) < t. 
In both cases J" = I n_1 . 
Case 3.1.1 a ^ acfo(A 8 ) 

Define: m(n) = m(n — 1) 

PI Induction hypothesis PI and the case assumptions imply that both T," and 

E m(„) = E m(„-1) ^ finite _ 

P2 Since £™ w is finite, we must prove that /fme(/i(Ef (n) ) .£r?) < ltime(Y, n ) < 
ltime(MZr (n) )-trj). 
The first inequality holds by induction hypothesis P2 and the facts that 

E m(„) = E m(„-1) and Uime ^ n) > l time ^n-ly 

For the second inequality 

ltime(Yi n ) = Itime(uj) 

< Itimeifii^-^A^.trj) 

1= /<ime(/,-(E7 ,( "- 1) ^ (/ 8 (Sr (n_1) )-^ o tome^"" 1 ))) Jrj) 

= tome(/ i (S™ (n - 1) ) Jrj o tome(S"- 1 )) 

J: /iimeC/.-CE^"- 15 ).^) 

^ ItimeifiW^.trj) 
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where steps 1 and 6 is trivial, step 2 follows from definition of (g,f) (cf. 
Definition 4.31), step 3 follows from induction hypothesis P3, step 4 follows 
from consistency of/; (cf. Condition 4 of Definition 4.16), and step 5 follows 
from the fact that the o operator preserves the limit time. 
P3 First note that X" n ' is finite. Then 

= S™ (n_1) ~ (MZ7 (n - iy ).trj <o ItimeCE"- 1 )) ~ 

(f i (X n - 1 \A i ).trj<ltime(X n )) 
= S™ (n_1) ~ (/,-(E7 ,( "" 1) ).<r7 o ItimeiZ"- 1 )) ~ 

(/ . (E -(«-D - (/..(E^"- 1 )).^ o /iimeCE"- 1 ))).^ o 

&me(S")) 

= £™ (n-1) ~ (/•(S™ (n " 1) ).^j o /iimeCE"- 1 )) ~ 

((/•(S™ (n_1) )Jrj o tome(S n - 1 )) o Mrae(E")) 

= S™ (n " 1} - (/-(S™ (n - 1} ) .trj <o ltime(E n )) 
± E -(»)^( / .( E -(»)).^ <5 / fime ( E n )) 

where steps 1 and 8 are trivial, step 2 follows from the fact that a ^ 
acts(Ai), step 3 follows from induction hypothesis P3, step 4 follows from 
the definition of (g,f) (cf. Definition 4.31), step 5 follows from induction 
hypothesis P3, step 6 follows from consistency of /■ (cf. Condition 4 of 
Definition 4.16), and step 7 follows from the definition of the operators and 
the fact that S"" 1 < t S n . 
P4 Again note that X" n ' is finite. Then 

-T-m(n) J_ ^7-m(n — 1) 

= t-seqiY' - S"" 1 ) \ (in(Ai) X T) 

= ((a, s.now) " t-seq(E' - S n )) \ (m(A,-) X T) 

= £-seg(£' - S n ) t (m(A,-) X T) 
where step 1 is trivial, step 2 follows from induction hypothesis P4, step 3 
follows from definition of t-seq and the fact that T," = S n_1 ~ uja{s}, and 
step 4 follows from the fact that a ^ acfo(A 8 ) and thus a ^ m(A 8 ). 
P5 Vacuously satisfied. 

Case 3.1.2 a G local(Ai) 

Since by induction hypothesis P1X; n_ ' is finite, 
(cj\A t ,a,s\A t ) = /.-(E"- 1 ^,-) 

2 /j(sr ("-i) ~ (/ .( E -(»-i)).^ <, /^^(E"- 1 ))) 

= /-(S™^- 1 )) o Itime^"- 1 ) 
where step 1 follows from the definition of (g,f) (Definition 4.31) and the fact 
that a G local(Ai), step 2 follows from induction hypothesis P3, and step 3 

53 



follows from consistency of /, (cf. Condition 4 of Definition 4.16). 

Thus, / 8 '(S™^ n_ ') = (oJi,a,S{), where oj{ o ltime(Y n ~ l ) = lo\A{ and s t = s\A t . 

Define: m(n) = m(n — 1) + 1 

E -(») = E ;"(»-i)~ (w . a{s . }) 

s-j-m(n) s-j-m(n — 1) 

PI Both S n and S™ (n) are finite. 

P2 Since Y" n ' is finite, we must prove that ftime( Ji(Y™ n ' ) .trj) < ltime(Y n ) < 
ltime(MYr (n) ).trf). 

Since ftime(J i (Y™' n ').tri) = ltime(ui) = ltime(u) = Ifime(S n ), the first 
inequivalence holds. 

The proof of the second inequality is similar to the one in subcase 3.1.1, only 
here the last step should use If!me(/,'(S; "~ )-trj) < ltime( fiiYj' ) -trj) . 
P3 First note that both Y" n ~ ' and Y" n ' are finite. 
Y"\A t = (S-^woW)^- 

= Y n ~ l \Ar (^Ai^Ai} 

1= Yf n - l) ~ (MYT (n - iy ).trj o Itime(Y^)) ~ KA 8 )a{^} 

= S™ (n_1) ~ (MYT (n ~ iy ).trj <o ltime(Y n - 1 )) ~ 

(MYf n - l) ).t r] o lUme(Y^))a{s\A % } 
± E -(»-i)^ (/ . (E -(»-i)).^ )a{srA . } 

7_ y,m(n) 
± E |»(»)-( / .( E -(»)).^< 5 /fi me ( E n)) 

where steps 1, 6, and 7 are trivial, step 2 follows from the fact that a £ 
acts(Ai), step 3 follows from induction hypothesis P3, step 4 follows from 
the properties of u\Ai proved at the beginning of this case, step 5 follows 
from definition of o and o, and finally step 8 follows from the fact that 
ltime{Y n ) = ltime{Yf n) )=ftime{f i {Y 1 f n) ).trj). 
P4 Again, note that both Y" n ~ ' and Y" n ' are finite. 

-T-m(n) J_ ^7-m(n — 1) 

= t-seq(Y' - S"" 1 ) \ (m(A,-) X T) 

= ((a, s.now) " t-seq(Y' -Y n j) \ (in(Ai) X T) 

= t-seq(Y' - Y n ) \ (m(A,-) X T) 
where step 1 is trivial, step 2 follows from induction hypothesis P4, step 3 
follows from definition of t-seq and the fact that Y" = S n_1 ~ uja{s}, and 
step 4 follows from a £ local(Ai) and thus a ^ m(A;). 
P5 If X™ n ~ ' = e, the result follows from the first case in the definition of 
R( g ,j,) (Definition 4.17). 

Now, assume 2™ 1 -™ - > = (b^t')T[. Then a ^ b since a £ local(A{) and 
6 £ m(A,-). Now, since J™^" 1 ) = £- seg (£' - S"" 1 ) \ (m(A,-) X T) and 
(a, s.now) is first on t-seq(Y' — S n_1 ), conclude that s.now < t' . Thus, 
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Itime(uji) = Itime(uj) = s.now < t ' . Then the result follows from the third 
case in the definition of R( gi j { )- 

Case 3.1.3 a G m(A,) 

Let u { = /,-(Er (n - 1) ).<r 7 -. 

Similar to proof P2 of subcase 3.1.1, it is easy to prove: ftime(uji) < ltime(T, n ) < 

Itime(uji). 

Then, let u>[ = u>i o ltime(Y, n ) and s' t = ^-(S™ w i? a )- 

Furthermore, 

lf n ~ l) = t-seq(X - S"" 1 ) \ (in(Ai) X T) 



2 



3 



((a, s.now) " t-seq(E' - S"" 1 )) \ (m(A,-) X T 



(a, s.now) " (f-seg(S' - S n ) t (m(^i) X T)) 
where step 1 follows from induction hypothesis P4, step 2 follows from the 
definition of S n , and step 3 follows from the fact that a £ in(Ai). Thus, in 
particular X" n ~ ' is not empty. 

Define: m(n) = m(n — 1) + 1 

I™(") = tail(lf n - l) ) 
PI Both S n and £™ (n) are finite. 
P2 Similar to the proof of P2 in subcase 3.1.2. 
P3 First note that both X" n ~ ' and X" n ' are finite. 

First, 

u\Ai = f^-^A^.trj oZftroe(E") 

= / 8 -(Sr (n_1) ~ (/,-(Er ( " _1) )-^' o toeiE"- 1 ))).^ o ltime(E n ) 
= (/i(S™ (n_1) ) Jrj o tome(S n - 1 )) o ltime(Y n ) 
= (uji o ltime(Y, n - v )) <o ltime{T, n ) 
where step 1 follows from the definition of (g,f) (Definition 4.31), step 2 
follows from induction hypothesis P3, step 3 follows from consistency of /,- 
(cf. Condition 4 of Definition 4.16), and step 4 follows from the definition 
of a;,-. 
Second, 

s\A { = </,-((E"- 1 -a;)rA,-,a) 
= g^-^Ar u\A„a) 

g i (i:f n ~ 1) ^(^<ltime(i: n - 1 ))- 

((w,- o ItimeiT,"- 1 )) o ltime(Z n )),a) 
5 .( E -(»-D^( a; . <3/fime ( E n )))a) 



3 



4 



5 /rimfn-l) ^ / \ 



± s< 



where steps 2, 5, and 6 are trivial, step 1 follows from the definition of 
(g,f) (Definition 4.31), step 3 follows from induction hypothesis P3, the 
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property of a; [A; proved above, and definition of a;;, and step 4 follows from 

the definition of the operators. 

Finally, 

X n \A { = V-^ArMAiMslAi} 

g ^(n-l) „ (mT (n-l ))Arj < torae(S n-l )} - (w ^ )a{s ^. } 

= X? ( - n - 1) ~(u i <ltime(E n - 1 ))~ 

((w,- o tome(S n - 1 )) o teme(S n ))a{^} 

5 y^m(n) 
A E |»(»)-( / .( E -(»)).^ <5 / f i me ( E n)) 

where steps 1 and 5 are trivial, step 2 follows from induction hypothesis P3, 
step 3 follows from the property of uj \A, proved above and the definition of 
Ui, step 4 follows from the definition of the operators, and finally step 6 fol- 
lows from the fact that /fme(/i(Ef (n) ) .trj) = Ifime(S; n) ) = Itime^uj^) = 
ltime(Yi n ). 
P4 First note that both X" n ~ ' and X" n ' are finite. 
I™(") k tail{lT {n ~ l) ) 

= tail((a, s.now) " (t-seq(Y,' - S n ) \ (in(Ai) X T))) 

= t-seqiY' - S n ) \ (in(Ai) X T) 
where steps 1 and 3 are trivial and step 2 follows from the property of 
j-m(n- ) p rove( j a |- ^g beginning of this case. 

P5 This follows directly from the fourth case in the definition of R( gi j { ) (Defi- 
nition 4.17). 

Case 3.2 Fourth case. 

The definition of R (gJ) gives us S n = S n - 1 ^w'a{s'}, l n ~ l = (a,t)l n , /(S"" 1 ).^;' = 
uj, Itime(uj) > t, uj' = uj o t, and g(X n_1 ~ uj' , a) = s'. Distinguish three subcases. 

Case 3.2.1 a £ acts(Ai) 

Similar to subcase 3.1.1. 
Case 3.2.2 a G local(Ai) 

This situation cannot occur since a £ in(A) (cf. Definition 4.10). 
Case 3.2.3 a G in(Ai) 

Similar to subcase 3.1.3. 

This concludes the inductive definition and induction proof. Since ra(0) = 0, m(n) is either 
m(n — 1) + 1 or m(n — 1), and (S™ ,2j™ ) an d (S™^ n \X™ n ') are defined every time m(n) = 
m(n— 1) + 1, (S",I") <n<(iim i ^ oo m(fc)) is defined. Furthermore, by the base case and the proof 
of P5 for every n with m(n) = m(n — 1) + 1: 

. (E°,X°) = (ErA,-,X,-)and 
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. for all < n < (lim*^ m(k)), ((Sr 1 ,^ -1 ), OW)) G %,„/,)• 

Using the results of the induction, the lemma can now be proven. Consider cases based on 

(S n ) n >o- 

1. One of S n is not finite. 

Then, by definition of R( g j), there exists a number n' > such that S n _1 is finite, S n 
is admissible, and for all n > n' , T," = T," . 

In the induction above each n > n 1 is handled by case 1. Since this case sets m(n) = 
m(n — 1) + 1, lim n ^oo m(n) = oo. Thus, (X",I") n > is defined and this sequence then 
forms an outcome sequence of (g,, fi) given £|"A; and I. Then 

ETA,- = (Um„^ 00 E n )rA,- 
= lim n ^ 00 (S"[A 8 ) 
— lim r ffl W 

= lim n ^ 00 £? 

where step 1 follows from the definition of £', step 2 follows from the continuity of the 
projection operator, step 3 follows from P3 since for all n > ra', S n [A; = £™ , and step 
4 follows from the fact that lim n ^oo m(n) = oo. 

Thus, £'[~Aj G (^^/^(SfAj,!), as required. 

2. All S n are finite. 

(a) lim^oo m(n) ^ oo 

Since m is nondecreasing, there exist natural numbers n' and m' such that for all 
n > ra', ra(n) = to'. Thus, (£™,X™) <„< m / is defined. In the induction above each 
n > n' is handled by either case 3.1.1 or 3.2.1 since all other cases set m(n) = 
m(n — 1) + 1. Cases 3.1.1 and 3.2.1 correspond to adding an action not in acts(Ai) 
to S n . Thus, £' — S n contains no actions from acts(Ai) which implies that |S' \ 
acts(Ai)\ = |S n \ acts(Ai)\ ^ oo since T," is finite. Thus, by hypothesis £' is not 
Zeno. Lemma 4.18 then implies that £' is admissible. 

Now, for all n > n' , PI and P2 imply that ltime(T 1 n ) < ltime(f i (T 1 f).trj). Since £' 
is admissible, lim n ^oo ltime(T, n ) = oo which implies that Ifirae(/i(S™ )-trj) = oo. 
Thus, fi(E™ ) = oj for some uj with Itime(uj) = oo. Furthermore, by P4, I™ = 
£-seg(£' - S n ') t (m(A,-) X T) = e. 

Define (£™' +1 ,I™' +1 ) = (S™' ~ w,I™'). Then by definition of %,„/,) (Defini- 
tion 4.17), ((£™',I™'),(£™' +1 ,I™' +1 )) G %,„/,)• Furthermore, for all A; > m' + 1, 
define (Sf, If) = (Sf" 1 , If" 1 ). 
Again, clearly ((S^ 1 ,!*" 1 ), (£*,!*)) G %,„/,). 
Thus, (S",I") n>0 is an outcome sequence of (g,, fi) given S[A 8 - and I. Now, 
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Z'\Ai = (Um„^ 00 E n )rA,- 

= lim^^fA,) 
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li mrwoo (£™ ~ (/ 8 -(S™ )Jrj o Zftme(E n ))) 



= lim^^) 

where step 1 follows from the definition of £', step 2 follows from the continuity of 

the projection operator, step 3 follows from P3, step 4 follows from the definition 

of uj and the fact that lim n ^oo ltime(T, n ) = oo, and step 5 follows from the fact that 
S n = S m' ~ u for all n > m /_ 

Thus, £'|"Aj G (^^/^(SfA^Zj), as required. 
(b) limjj^oo ra(n) = oo 

In this situation (S",I")„> is an outcome sequence of (g,, fi) given £[~Aj and I,. 

Then 

ETA,- = (Um„^ 00 E n )rA,- 

= lim^CE" |"A,-) 

I: lim_ 00 (S™ (n) - (/ 8 (Sr (n) )-^J o Zftroe(E"))) 

= lim n ^ 00 (S™ (n) ) 

= lim^^) 
where step 1 follows from the definition of £', step 2 follows from the continuity of 
the projection operator, step 3 follows from P3, step 4 follows from the fact that for 
all n, £™ (n) < t £™ (n) ~ (/ 8 -(S™ (n) ) Jrj o ltime(Z n )) < t S™ (n)+1 (this follows directly 
from the definition of X" n ' for all n where m(n) = m(n — 1) + 1), and finally step 
5 follows from the fact that lim n ^oo m(n) = oo. 
Thus, £'|"Aj G 0(g t j^(Y<\Ai,2i), as required. 

This concludes the proof. ■ 

Lemma 4.34 

Let (A l7 Li), . . ., (A N , L N ) be compatible live timed I/O automata and let, for each 1 < i < N , 
(gi, fi) be an environment-free strategy for (Ai,L{ U t-exec zt (Ai)). Furthermore, let (A, L) = 
(Ai, ii)|| • • • \\(A N ,L N ). Then (g, f) = (#i, /i)|| • • • \\(g N , In) is an environment-free strategy 
for (A,LU t-exec zt {A)). 

Proof. Definition 4.22 given the following proof obligations. 

1. A is a safe timed I/O automaton, 

2. L U t-exec zt (A) C t-exec(A), 

3. (9( 3 j)(S,I) C LL)t-exec zt (A), for all X G t-exec* ( A) and all timed environment sequences 
X for A that are compatible with X, and 
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4. (g,f) is Zeno-tolerant. 
Consider the points one at a time. 

1. Definition 4.25 along with Definition 4.10 directly implies that A is a safe timed I/O 
automaton. 

2. By Definition 4.25, L = {£ G £-e;rec(A) | £|"Ai G £i,...,£[Ajv G L N }. Thus, 
Lemma 4.11 implies L C t-exec(A). Finally, since £-e;rec z *(A) C t-exec(A), the result 
follows. 

3. Let X G t-exec* (A) be an arbitrary finite timed execution of A and X be an arbitrary 
timed environment sequence for A that is compatible with X. Note, since (gi, fi) is 
an environment-free strategy for (A^i, U t-exec zt (A{)), (gi, fi) is, by Definition 4.22, a 
Zeno-tolerant strategy defined on A,. Let £' be an arbitrary element of the outcome 
(9( 3 j)(S,I). By Lemma 4.18, X is either Zeno or admissible. 

• Assume £' is Zeno. 

By Lemma 4.18, £' contains infinitely many actions (|S' \ acts(A)\ = oo). Assume 
£' is not Zeno-tolerant (£' G t-exec zt (A)). Then |S' [" /oca/(A)| = oo. Since each 
locally-controlled action in £' belongs to the locally-controlled actions of one of the 
component automata of A, and there are only finitely many such components, there 
exists an i such that |S' \local(Ai)\ = oo which also implies |(£'|"Aj) \local(Ai)\ = oo. 
Lemma 4.33 now implies the existence of a timed sequence I, over in(Ai) compatible 
with S \Ai such that £' [A; G C^j^El'Aj,!;). Since £' [A; is Zeno (by Lemma 4.11) 
and |(S'[~Aj) \ /oca/(A 8 )| = oo, there is a contradiction to the fact that (gi, fi) is 
Zeno-tolerant. 
Thus, £' G £-e;rec z *(A). That suffices. 

• Assume £' is admissible. 

By Lemma 4.33, for each 1 < i < N there exists a timed sequence I, over in(Ai) 
compatible with S[A 8 -, such that S'fA, G 0( gt j^(Y<\Ai,2i). By Lemma 4.11, S'fA, 
is admissible. Now the fact that (gi, fi) is an environment-free for the pair (A,, Li U 
t-exec zt (Ai)) implies that S'fA, G L{. This implies, by Definition 4.25, that £' G L. 
That suffices. 

4. To prove that (g,f) is Zeno-tolerant (cf. Definition 4.21), it suffices to note that the 
previous case says that (9( 3 j)(S,I) ClU t-exec zt (A), where L C t-exec co (A). ■ 

The main result, closure of the parallel composition operator, can now be proven. 

Proposition 4.35 (Closure of parallel composition) 

Let (Ai, Li), . . ., (A N , L N ) be compatible live timed I/O automata. Then the parallel composi- 
tion (Ai, Li)\\ . . . ||(Ajv, L N ) is a live timed I/O automaton. 
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Proof. Let (A,L) = (A l7 Li)\\ ■ ■ ■ \\(A N , L N ). Definition 4.10 implies that A is a safe timed 
I/O automaton. Furthermore, since Li C t-exec°°(Ai), Lemma 4.11 and Definition 4.25 show 
that L C t-exec°°(A). 

For each 1 < i < N, let (g t , fi) be an environment-free strategy for (Aj,£j U t-exec zt (Ai)). 
By Lemma 4.34 the strategy (g,f) = (<?i, /i)|| • • • ||(#jv, /jv) is an environment-free strategy 
for (A, 1- U t-exec zt (A)). Therefore, the pair (A, L U t-exec zt (A)) is environment-free. By 
Definition 4.23 of live timed I/O automata, the result now follows. ■ 

4.5 Preorder Relations for Live Timed I/O Automata 

For safe timed I/O automata there are several ways of defining a timed trace preorder that 
depend upon which kinds of traces are being considered. A naive choice would be to consider 
ah the timed traces of a safe timed I/O automaton; however, one might not be interested in, 
e.g., the Zeno timed traces of a system. For the live preorder, on the other hand, there is a 
unique natural choice. 

Definition 4.36 (Timed trace preorders) 

Given two live timed I/O automata (A l7 Li) and (A 2 , L 2 ) such that esig(Ai) = esig(A 2 ) define 
the following preorders: 

Safe: (A l7 L±) C st (A 2 , L 2 ) iff t-traces(Ai) C t-traces(A 2 ) . 

Safe-finite: (A l7 L{) C* t (A 2 , L 2 ) iff t-traces*(A l ) C t-traces*(A 2 ). 

Safe-admissible: (A u L{) C~ (A 2 , i 2 ) iff ^races 00 ^) C f-fraces°°(A 2 ). 

^a/e-non-^eno: (A l7 XJ C- (A 2 , X 2 ) iff (A l7 XJ C* t (A 2 , L 2 ) and (A l7 XJ C~ (A 2 , X 2 ). 

Life: (Ai, ii) C Lt (A 2 , i 2 ) iff t-traces(Li) C t-traces(L 2 ). ■ 

The safe-non-Zeno preorder is the relation that is used in [VL92]. This preorder is used in 
[VL92] instead of the more natural safe-admissible preorder since finite timed traces are need 
for substitutivity of a sequential composition operator. 

It is interesting to note that the live preorder implies the safe preorder whenever the involved 
safe timed I/O automata have timed finite internal nondeterminism. On the other hand, if 
the involved safe timed I/O automata do not have timed finite internal nondeterminism, then 
the live preorder only implies finite timed trace inclusion. Essentially, timed finite internal 
nondeterminism requires that a timed automaton has a finite internal branching structure. In 
particular, a finite timed trace can lead to at most finitely many states. 

Definition 4.37 (Timed finite internal nondeterminism) 

A timed automaton A has timed finite internal nondeterminism (t-FIN) iff, for each trace 
7 G t-traces* '(A) , the set {lstate(T,) \ t-trace(T,) = 7} is finite. ■ 

Proposition 4.38 

Let (Ai,Li) and (A 2 ,L 2 ) be two live timed I/O automata with vsig(Ai) = vsig(A 2 ). 
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1- If(A 1 ,L 1 ) C~ (A 2 ,L 2 ) then (A^L,) C* t (A 2 ,L 2 ). 

2. IfA 2 has t-FINand{A u L 1 ) C* t (A 2 ,L 2 ) then (A^L^ C st (A 2 ,£ 2 ). 

5. IfiA^Lj C Lt (A 2 ,£ 2 ) </»en (A^) Q t (A 2 ,i 2 ). 

Proof. 

1 . Let 7 be a finite timed trace of A x ■ By definition of timed trace, there is a timed execution 
Si of Ai such that t-trace(T,i) = 7. By definition of live timed I/O automaton there 
exists an admissible timed execution T,[ of A x such that Si < t S' : and t-trace(T,[) £ 
L\ (just apply any environment-free strategy for (Ai,Li) to Si and to an admissible 
timed environment sequence for A compatible with Si). By definition of live timed I/O 
automaton, S' : is a timed execution of A±. Since (Ai,Li) C^j (A 2 ,L 2 ), there exists a 
timed execution S' 2 of A 2 such that ^-^race(S' 1 ) = t-trace(T,' 2 ). Since the set of timed 
executions of a timed I/O automaton is closed under t-prefix, there is a t-prefix S 2 of S' 2 
such that S 2 is a timed execution of A 2 and t-trace(T, 2 ) = 7, i.e., 7 is a timed trace of 
A 2 . 

2. This is a standard result that appears in [LV91]. 

3. Let 7 be a finite timed trace of A±. By definition of timed trace, there is a timed execution 
Si of Ax such that t-trace(Y<i) = 7. By definition of live timed I/O automaton there 
exists a timed execution S' : of A x such that Si < t T,[ and t-trace(T,[) £ L\. Since 
(Ai,Li) C Lt (A 2 ,L 2 ), there exists a timed execution S' 2 of L 2 such that ^-^race(S' 1 ) = 
t-trace(Y< 2 ) . By definition of timed live I/O automaton, S' 2 is a timed execution of A 2 , 
and, since the set of timed executions of a timed automaton is closed under t-prefix, 
there is a t-prefix S 2 of S' 2 such that S 2 is a timed execution of A 2 and t-trace(T, 2 ) = 7, 
i.e., 7 is a timed trace of A 2 . ■ 

The important property of the safe and live preorders is that they are substitutive for the 
operators of Section 4.4. In the case of the parallel composition operator, this means that 
an implementation of a system made up of several parallel components can be obtained by 
implementing each component separately. 

Theorem 4.39 (Substitutivity) 

Let (Ai, Li), (Aj-, £'•), i = 1,...,N be live timed I/O automata, and let C x be one relation 
among C st , \Z* tt C~, C^ and C Lt . //, for each i, (A,-,^) Q x (A^L'A, then 

1. if (Ai, L\ ),..., (Ajv, L N ) are compatible and (A^i^), . . .,(A' N ,L' N ) are compatible then 

(A l ,L l )\\..^\(A N ,L N )n x (A' 1 ,L' 1 )\\...\\(A' N ,L' N ). 

2. if A C /oca/(Ai) and A C local(A[) then 

(Ai,ii)\AC x (A' 1 ,i' 1 )\A 
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3. if p is a mapping applicable to both A x and A[ then 

K(A 1 ,Ii))Ex/»P 1 ,£' 1 )) 

Proof. The substitutivity results are a direct consequence of Lemmas 4.11, 4.13, and 4.15, 
and the observation, analogous to the one of the untimed model, that parallel composition, 
hiding and renaming of timed execution sets preserve timed trace equivalence. ■ 

4.6 Comparison with Other Timed Models 

This section compares our timed model with the work of [AL91b, MMT91, VL92]. 

The formalism that is used in [AL91b] is the Temporal Logic of Actions (TLA) [Lam91] 
extended with a new variable now that models time. A specification S consists of the conjunc- 
tion of three formulas Init AIL A L where Init represents the initial configurations of 5, II is a 
safety property, and L is a liveness property. The subformula Init A LL corresponds to our safe 
timed I/O automata, while the subformula L corresponds to our timed liveness conditions. In 
[AL91b] L can also be satisfied by finite or Zeno executions or by executions that do not satisfy 
Init A LL. The formula L is a liveness condition for Init A LL based on our definition iff the pair 
(Init A LL,L) is machine- closed based on the definition in [AL91b]. 

There is a special formula NZ in [AL91b] that is used to express non-Zenoness, i.e., that 
time advances forever. Time blocking or Zeno behaviors are undesirable in [AL91b] as well as 
in our model; however, it is possible for the safety part of a specification to describe systems for 
which time cannot advance past a given upper bound whenever a particular state is reached. 
Such a situation is eliminated in [AL91b] by requiring the pair (II, NZ) to be machine- closed. 
In our model, on the other hand, the same situation is eliminated by the fact that system-Zeno 
executions are not allowed in the liveness part of a live timed I/O automaton and that a live 
timed I/O automaton is machine- closed by definition. 

A major difference between our notion of environment-freedom and the notion of recep- 
tiveness of [AL91b] is in the role of time: in our model no one is allowed to have control over 
time; in [AL91b] either the system or its environment must have control over time. We believe 
that it is more reasonable to assume that no one has control over time, and thus consider our 
model easier to understand. 

The model of [MMT91] is an extension to the timed model of the I/O automaton model of 
[LT87]. The locally-controlled actions of an automaton are partitioned into classes, each one of 
which is associated with a lower bound (possibly but not oo) and an upper bound (possibly oo 
but not 0). Actions from one class with lower bound C\ and upper bound c 2 must stay enabled 
for at least C\ time units before one of them can be performed, and cannot stay enabled more 
that c 2 time units without any one of them being performed. 

An automaton M of [MMT91] can be represented in our model as a pair (A, L) where A is 
a safe timed I/O automaton with a transition relation that satisfies all the timing constraints 
of M, and L is the set of all admissible executions of A. It is easy to check that (A,L) is 
environment-free and that admissible timed trace inclusion in [MMT91] coincides with live 
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trace inclusion in our model. However, there are liveness conditions that can be represented 
in our model but cannot be represented naturally in the model of [MMT91]. 

The work in [VL92] does not deal with general liveness properties, and argues that finite and 
admissible timed traces inclusion is generally sufficient to express a useful notion of implemen- 
tation whenever time is involved. The work in [SLL93], however, has shown that liveness is 
useful even in a timed model. In general, the automata of [VL92] are not receptive, however, in 
order to avoid trivial implementations, [VL92] assumes some form of I/O distinction and some 
form of receptiveness at the lower level of implementation. There is a very close connection 
between the technical definitions of I/O feasibility and strong I/O feasibility of [VL92] and 
our notion of environment-freedom. It is possible to represent each timed I/O automaton A 
of [VL92] with the pair (A, L) where L is the set of admissible executions of A. The notion 
of I/O feasibility of [VL92], which requires each finite timed execution of A to be extendible 
to an admissible timed execution of A using locally-controlled actions only, is stronger than 
requiring that L is a liveness condition for A and weaker than requiring that (A, L) is a live 
timed I/O automaton. In order to have closure under parallel composition, [VL92] introduces 
a stronger requirement on I/O automata called strong I/O feasibility. Strong I/O feasibil- 
ity adds to I/O feasibility the requirement that the safe part of an I/O automaton A does 
not exhibit any system-Zeno execution. However, environment-freedom, which is weaker than 
strong I/O feasibility since the safe part of a live timed I/O automaton is allowed to exhibit 
system-Zeno behaviors, is sufficient to guarantee closure under parallel composition and hence 
substitutivity. 

5 Embedding the Untimed Model in the Timed Model 

The untimed model, presented in Section 3, is used to specify systems where the amount of 
time that passes between actions is considered unimportant. Many problems in distributed 
computing can be stated and solved using this model. However, it is not possible to state 
anything about, e.g., response times in the untimed model. It is implicitly assumed that the 
final implementation on a physical machine is "fast enough" for practical use. 

An untimed system can be thought of as a timed system that allows arbitrary time-passage. 
This indicates that the timed model is, in some sense, more general than the untimed model, 
and that one could use the timed model in situations where one would usually use the untimed 
model. However, the timed model is more complicated than the untimed model due to the 
time-passage action, the now component, etc. Furthermore, it does not seem natural to be 
required to deal with time, when the problem to be solved does not mention time. 

Thus, one would like to work in the untimed model as much as possible and only switch 
to the timed model when it is needed. Sometimes, however, an algorithm that uses time 
implements a specification that does not use time. For example, [LLS93] shows how an untimed 
specification (of the at-most-once message delivery problem) is implemented by a system that 
assumes upper time bounds on certain process steps and channel delays. Fischer's mutual 
exclusion algorithm [Fis85, AL9Ib] is another such example. Figure I depicts the stepwise 
development one would use for an implementation proof like the one in [LLS93]. The stepwise 
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> Untimed 



> Timed 



Figure 1: A stepwise development from an untimed specification to a timed implementation. 



development in Figure f , however, raises the issue of what it means to implement an untimed 
specification with a timed implementation. Our approach to this issue is to convert the untimed 
systems in the stepwise development to timed systems by applying a patient operator that adds 
arbitrary time-passage steps. The patient operator we use is similar to the one of [NS92, VL92]. 
To complement the patient operator, this section proves the Embedding Theorem which states 
that a concrete level implements an abstract level in the untimed model if and only if the 
patient version of the concrete level implements the patient version of the abstract level in 
the timed model. Thus, the first part of the stepwise development of Figure 1 can be carried 
out entirely in the simpler untimed model, and the last part in the timed model. In the 
intermediate development step which goes from untimed to timed, one must prove that the 
timed level implements the patient version of the untimed level. The embedding theorem can 
then be applied to show that the implementation IMPL implements the patient version of the 
specification SPEC. 



Definition 5.1 (Patient operator on safe I/O automata) 

Let A be a safe (untimed) I/O automaton where v ^ acts(A). Then define patient(A) to be 
the safe timed I/O automaton with 

• states(patient(A)) = states(A) X T 

If s = (s',t) is a state of patient(A), we let s. basic denote s' . 

• start(patient(A)) = start(A) X {0} 



• now 



patient(A){{ s i t)) — t 
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• ext(patient(A)) = ext(A) U {//} 

• in(patient(A)) = in(A) 

• out(patient(A)) = out (A) 

• int(patient(A)) = int(A) 

• steps(patient(A)) consists of the steps 

- {((s,t),a,(s',t)) | (s,a,s') G steps(A)} 

- {((s,t),u,(s,f))\f>t} m 

The following trivial lemma states that the basic state of a patient automaton does not change 
during time-passage in a timed execution. 

Lemma 5.2 

Let A be a safe I/O automaton with v ^ acts(A) and let X = cj ai^ia2^2 • • • be a timed 
execution of patient(A). Then, for all i and all s,s' £ rng(uji), s. basic = s'. basic. ■ 

In order to state what it means to apply the patient operator to a live I/O automaton, the 
following auxiliary definition of what it means to untime a timed execution is needed. Let A 
be a safe I/O automaton with v ^ acts(A) and let S = uj aiUJia 2 ijJ2 • • • be a timed execution of 
patient(A). Then define 

untime(T,) = (fstate(uj ) .basic)ai(fstate(uji) .6as«c)a 2 (/state(cj 2 ) .basic) ■ ■ ■ 

Similarly, let 7 = ((aijii)^^) • • -,t) be a timed trace of patient(A). Then define 

untime(j) = a^a^ ■ ■ ■ 

Lemma 5.3 

Let Abe a safe I/O automaton with v ^ acts(A). Then S G t-exec(patient(A)) iff untime(Y,) £ 
exec(A). Furthermore, ifT, is finite, then untime(T,) is finite. 

Proof. The proof of this lemma is trivial using Lemma 5.2, Definition 5.1, and the definition 
of untime. ■ 

The patient operator can now be extended to live I/O automata. For any live I/O automaton 
(A, L), the patient live I/O automaton of (A, L) should be the live timed I/O automaton whose 
safety part is patient(A) and whose liveness part consists of ah those admissible executions 
that, when made untimed, are in L. Thus, the liveness condition of the patient live I/O 
automaton allows time to pass arbitrarily, as long as the liveness prescribed by L is satisfied 
sooner or later. This is formalized in the following definition. 
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Definition 5.4 (Patient operator on live I/O automaton) 

Let (A,L) be a live I/O automaton with v ^ acts(A). Then, define patient A (L) = {X £ 
t-exec°° (patient(A)) \ untime(T,) £ £}, and define patient(A,L), the patient live I/O automa- 
ton of (A, £), to be the pair (patient( A), patient A (L)). ■ 

One must prove that for any live I/O automaton (A,L), patient(A, L) is a live timed I/O 
automaton. This means showing the existence of an environment-free strategy for the pair 
(patient( A), patient A (L) U t-exec zt (patient(A))). This is accomplished by defining the patient 
strategy of an (untimed) strategy (g, /) defined on A, and showing that the patient strategy of 
(g,f) is environment-free for (A p ,L p U t-exec zt (A p )), where (A p ,L p ) = patient(A,L), if (g,f) 
is environment-free for (A,L). To ensure that the patient strategy of (g,f) is Zeno-tolerant, 
which is required for environment-freedom, the patient strategy of (g, /) insists on letting time 
pass some fixed positive amount of time 8 before making a local step. 
To formalize this idea, the following definition is needed. 

Definition 5.5 

For any safe timed I/O automaton A and any finite timed execution S of A, define Uoctime(T,) 
to be the time of occurrence of the last locally-controlled action in S, or if no such action 
exists. Formally, let S = oj aiOJi ■ ■ ■ a n uj n . If a l5 . . . , a n ^ local(A), then define Uoctime(T,) = 0; 
otherwise, define Uoctime(T,) = ftime(uj k ) where a k £ local(A) and a k+ i, . . . , a n ^ local(A). ■ 

Definition 5.6 (Patient strategy) 

Let A be a safe I/O automaton with v ^ acts(A) and (g,f) be an (untimed) strategy defined 
on A. Furthermore, let A p = patient(A). Then define the patient strategy of (g, /) with respect 
to some positive real number 8, written patient s (g, /), to be the pair of functions 

g p : t-exec* (A p ) X m(A p ) — ► states(A p ) 

f p : t-exec* (Ap) —^ (traj(A p ) X local(A p ) X states(A p )) U traj(A p ) 

defined in the following way 

g p (Y<,a) = (g(untime(Yi),a),ltime(Y<)) 

(u,a,s) if f(untime(Yi)) = (a,s.basic), s.now = Itime(uj) and 
dom(uj) = [Itime(Yi), max(ltime(T,), Uoctime(T,) + <*))] 
f / v x a i rng(uj) = {(lstate(T,). basic, t) \ t £ dom(uj)} 

p "a; if f (untime(Yi)) = _L and 

dom(uj) = [Itime(Yi), oo] 
rng(uj) = {(lstate(T,). basic, t) \ t £ <iora(cj)} 
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For finite timed executions X of A p , Lemma 5.3 impiies that untime(T,) is a finite execution of 
A. Aiso, by Definition 5.1, A and A p have the same input, output, and internal actions. Thus, 
in the definition of (g p ,f p ), the domains and ranges of g and / are compatible with the usage 
of g and /. 

The following lemma states that the patient strategy is indeed a strategy. 

Lemma 5.7 

Let A be a safe I/O automaton with v ^ acts(A), (g,f) an (untimed) strategy defined on A, 
and 8 any positive real number. Then patient s (g, f) is a (timed) strategy defined on patient(A) . 

Proof. Let (g p , f p ) = patient b (g, f) and A p = patient(A). To verify that (g p , f p ) is a (timed) 
strategy defined on A p check the four conditions of Definition 4.16. 

1. For the first condition, which deals with g p , let, for arbitrary X G t-exec* (A p ) and 
a G in(A p ), g p (T,,a) = s = (s',t). By the definition of g p and the fact that (g,f) 
is a strategy defined on A (cf. Definition 3.11), (lstate(untime(T,)),a,s r ) G steps(A) 
which, by definition of untime, Lemma 5.2, and the fact that X is finite is the same as 
(Istate(Yi). basic, a, s') G steps(A). Finally, Definition 5.1 and the fact that t = ltime(T,) 
gives (lstate(T,),a,s) G steps(A p ), which suffices. 

2. For the second condition let / P (S) = (uj,a,s). Similar to the first condition, it is easy 
to see that (lstate(uj),a,s) is a step of A p . Then by the definition of uj and the fact 
that A p allows time to pass arbitrarily, uja{s} is a timed execution fragment of A p and 
fstate(uj) = lstate(T,). Thus, E"wa{s} G t-exec* (A p ) as required. 

3. The argument parallels that for Condition 2. 

4. Finally, the fourth condition, dealing with consistence of f p , is considered. 

(a) Assume / P (S) = (u,a,s) and let t be a time such that ftime(uj) <t< Itime(uj). 
By definition of f p we have f(untime(T,)) = (a, s. basic), s.now = Itime(uj), and 
dom(uj) = [Itime(Yi), max(ltime(T,), Uoctime(T,) + 8)] and 
rng(uj) = {(lstate(T,). basic, t') \ t' G dom(uj)}. 

By definition of untime, we have untime(T, " (u < <)) = untime(T,), which implies 
f(untime(T, ~ (uj o t))) = f(untime(T,)). 

Thus, / P (S " (wo t)) = (uj',a,s r ) with f(untime(T, ~ (a; o i))) = (a, s'. basic) = 
(a, s. basic), s' .now = Itime(uj'), and dom(uj') = [ltime(T, ~ (a; o i)), max(ltime(T, ~ 
(a; of)), Uoctime(Y<~ (uj oi)) + <*>)] and rng(uj') = {(lstate(Y<~ (uj ot)). basic, t') \ t' G 
dom(u')}. 

Now, by Lemma 5.2 lstate(T, ~ (uj o t)). basic = lstate(T,). basic, and furthermore 
we have, by the definitions of o and Uoctime, that ltime(T, ~ (u; o i)) = i and 
Uoctime(T, " (u < <)) = Uoctime(T,) 
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Assume ltime(T,) > lloctime(T,) + 8. Then ftime(uj) = Itime(uj) = t = ltime(T,), and 
max(ltime(T, ~ (a; o t)), lloctime(T, ~ (a; o i)) + <*)) = max(ltime(T,), lloctime(T,) + <*)). 
Then assume ltime(T,) < lloctime(T,) + 8. Then t < Itime(uj) = lloctime(T,) + 8, and 
again we have max(ltime(T 1 "(ujot)), lloctime(T,^(uj<it)) + 8) = max(t, lloctime(T,) + 
8) = Uoctime(Yi) + 8 = max(ltime(T,), lloctime(T,) + 8). 

Thus, we have dom(uj') = [ltime(T, ~ (uj o t)), max(ltime(T, ~ (uj o t)), Uoctime(T, ~ 
(uj o t)) + 8)] = [t, max(ltime(Y<), Uoctime(Y<) + 8)] = dom(uj o t) and rng(uj') = 
{(lstate(Y< ~ (a; o t)). basic, t') \ t' G <iora(cj)} = {(lstate(T,). basic, t') \ t' G dom(uj o 
i)} = rng(uj o i). Therefore, uj' = uj o t and s' .now = Itime(uj') = Itime(uj) such 
that s' = s. 

Hence, finally conclude that / P (S ^ (a; o i)) = ((uj o i), a, s), as required. 
(b) Assume / P (S) = a;. This case is handled similarly to the previous case. 

Thus, (g p , f p ) is a strategy defined on A p . ■ 

The proof that for any environment-free (untimed) strategy (g,f) for a live I/O automaton 
(A, £), and any positive 8, the patient strategy patient s (g, /) is an environment-free (timed) 
strategyfor (A p , £ p LU-e;rec z *(Ap)), where (A p ,i p ) = patient(A, L), uses two technical lemmas. 
The first of these lemmas states that if £' is an admissible timed execution of an outcome of 
patient s (g, /), then untime(Yi') is an outcome of (g,f). This expresses the intuitive idea that 
the only significant difference between (g,f) and patient(g,f) is due to time-passage. The 
second lemma states that the difference in the time of occurrence of any two locally-controlled 
actions in a timed execution of an outcome of patient s (g, /), is at least 8. This is, of course, 
due to the fact that patient s (g, /) insists on letting time pass for at least 8 time units between 
local steps. 

Lemma 5.8 

Let A be a safe I/O automaton with v ^ acts(A) and let (g, /) be an (untimed) strategy defined 
on A. Let A p = patient(A) and (g p , f p ) = patient s (g, f) for some arbitrary positive real number 
8. Then, for all S G t-exec*(A p ), all timed environment sequences I p for A p compatible with 
S, and all admissible £' G 0( 9v j v - } (T 1 ,I p ), there exists an environment sequence J for A such 
that untime(T,') = 0( g j^(untime(Yi),T). 

Proof. First note that by Lemma 5.7, (g p ,f p ) is a strategy defined on A p . 

Let S G t-exec* (A p ) be an arbitrary finite timed execution of A, I p an arbitrary timed 
environment sequence for A p compatible with S, and £' be an arbitrary admissible timed 
execution of the outcome (9( 3 j )(£,X P ). Let R( g j ) be the next-relation induced by (g p ,f p ) 
and R( g j) the next-function induced by (g,f). Also, let (S n ,2T) n > be an outcome sequence 
of (g p , f p ) given S and X v such that £' = lim n ^oo S n . 

Let N — ► N be the signature of a total, nondecreasing mapping m. Define m(n) induc- 
tively on n. Furthermore, define I -0 (a finite sequence over in(A) U {A}) and for each n > 
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and each m(n — 1) < k < m(n) define X k such that X ( k ^ < X k . After the definition show 
that this ieads to a chain (X~ n ) n>0 , ordered by prefix, and iet X = linijj^ooZ - ™. 

Base case n = 0: 

Define: ra(0) = 

X-° = s 

Inductive step n > 0: 

(S n ,I") is reiated to (S n_1 ,I" _1 ) according to exactly one of the five cases in the definition 
of R( g j ) (cf. Definition 4.17). Consider these five cases: 

1. Define: m(n) = m(n — 1) + 1 

-7~— m(n) -7~— (m(n)— 1) \ 

2. Define: m(n) = m(n — 1) 

3. Define: m(n) = m(n — 1) + 1 

-T—m(n) -T— (m(n)— 1) \ 

4. Here let (a,t) = head{X^- r ). 

(a) Assume / p (S n_1 ) = to 
Define: m(n) = m(n — 1) + 2 

J-(m(n)-l) _ J-(m(n)-2)^ 
J-m(n) _ j-(m(n)-l) a 

(b) Assume / p (S n_1 ) = (u,b,s) 
Define: m(n) = m(n — 1) + 1 

J-m(n) _ j-(m(n)-l) a 

5. Define: m(n) = m(n — 1) + 1 

n~—m(n) -7"— (m(n)— 1) \ 

This concludes the inductive definition. Only case 2 above does not increment m. However, 
this case occurs at most once, namely if S n_1 is finite and S n is not. Thus, lim n ^oo m(n) = oo. 
This also implies that (X~ n ) n>00 is a chain ordered by prefix. Now, define X = liniyj^ool - " 
and, for all n, let X n = X - X~ n . (Thus, X~ n " X n = X.) 

We now argue that X is an environment sequence for A. With an argument similar to the 
one that shows lim n ^oo m(n) = oo, it is easy to see that X is infinite. Now, assume that X 
does not contain infinitely many occurrences of A. This implies that there exists a number n 1 
such that for all n > ra', the inductive step is handled by case 4b above. Let, for all k > n 1 , 
f p (Yi k ) = (uj k ,a k ,s k ). Then by definition of f p , ltime(uj k ) = max(ltime(T, k ),Uoctime(T, k ) + S) 
which, since case 4b adds input actions, equals max(ltime(T, k ), Uoctime(T, n ) + S). 
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• Assume Uoctime(J: n )+8 > ltime(J: n ). Then to'me(S n +1 ) < ltime(uj n ) = //oc^'rae(£ n ) + 
8. By induction it is easy to see that for all k > n' , ltime(T, k ) < Uoctime(T, n ), which 
implies that ltime(Y<') < Uoctime(T, n ). But this contradicts the fact that £' is admissible. 

• Assume Uoctime(T, n ) + 8 < ltime(T, n ). Then ltime(T, n +1 ) < ltime(uj n ) = ltime(T, n ), 
and, by definition of R( gpJp ), ltime{T 1 n ' +l ) > to'me(S n '). Thus, ltime{T 1 n ' +l ) = to'me(S n '). 
Again, by induction, ltime(Y<') < ltime(T, n ), and since S n is finite, this contradicts the 
fact that £' is admissible. 

Thus, both cases lead to a contradiction, which allows the conclusion that X contains infinitely 
many occurrences of A. Finally, X consists of actions from in(A p ) U {A}. Since, by Defini- 
tion 5.1, in(A) = in(Ap), X is an infinite sequence over in(A) U {A} containing infinitely many 
occurrences of A. Thus, X is an environment sequence for A. 

Similar to the way (X~ n ) n>0 is defined, now define a chain (a n ) n >o of executions of A, 
ordered by prefix. Thus, define a and, for each n > and each m(n — 1) < k < ra(n), a k 
such that a k ~ 1 < a k . In the same induction prove, for each n: 

PI untimeiT,") = a m ^ n \ 

P2 If re > and for each m(n - 1) < k < m(n), R( g j- ) (a k ~ 1 ,l k ~ 1 ) = (a k ,X k ). 

Base case n = 0: 

Define: a = untime(T,) 

PI untime(Y, ) = untime(Y,) = a = a m ^°\ 
P2 Vacuously satisfied. 

Inductive step n > 0: 

Assume PI as induction hypothesis. Again consider the five cases in the definition of R^ g j y 

Case 1 Here (S n ,2^) = (S n - 1 ^wa{s},2^- 1 ) with/ p (S n " 1 ) = (w,a,s). Then, by definition of 
(g p ,f p ), f{untime(T 1 n ~ 1 )) = (a, s. basic). Furthermore, by the induction hypothesis and 
the definition of m(n), untime(Y 1 n ~ 1 ) = a m(n_1 ) = a m(n ) _1 . 

Define: a m ^ = a m{n ^- l a(s. basic) 

PI untime{Yj n ) = untime(Y 1 n ~ l ~ uja{s}) = untime(Y 1 n ~ l ) ~ untime((jja{s}) = a m ( n_1 ) ~ 
(fstate(ij).basic)a(s. basic) = a m ^~ 1 a(s. basic) = a m(n K 

P2 This condition must be shown for k = m(n). 

Definition of J-"(») above implies X">(»)-i = X - j-(™(«)-i) = \(j - !-"(")) = 

AI m(n ). 

By case 1 of the definition of R( g j) (cf. Definition 3.12) the result now follows. 
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Case 2 Here T," = T," 1 ~ uj where uj = f p (T," 1 ). Also m(n) = m(n — 1) in this case. 

PI untime(Y, n ) = untime(T 1 n - 1 ~ uj) = untime(T 1 n - 1 ) = a" 1 '"" 1 ' = a m(n K 
P2 Vacuously satisfied. 

Case 3 This case is handled similarly to case 1. 

Case 4 Here, let (a,t) = head(l™- 1 ). Then, (S n ,I p n ) = (S n_1 ~ uj'a{s'}, tail^- 1 )), where 
uj' = (/ p (S n_1 ) .trj) o i and s' = g p (X n_1 ~ a/, a). Then, the induction hypothesis 
and the definition of (g p ,f p ), imply g(untime(T 1 n ~ 1 ~ us'), a) = g(untime(T 1 n ~ 1 ),a) = 
g(a m(n-1 ), a) = s'. basic. 

Case 4.1 Assume / p (£" _1 ) = uj 

Then the induction hypothesis and the definitions of (g p , f p ) and ra(n), imply 

/(tintJme(S n - 1 )) = /(a" 1 '"" 1 ') = /(a m ( n )- 2 ) = J_. 

Define: a" 1 '"'" 1 = a m ( n )- 2 

a m ( n ) = a ml - n ^- l a{s'. basic) 

PI untime(Yi n ) = untime(T 1 n ~ 1 ~ a;' 'a{s'}) = untime(T, n ~ 1 )a(s' .basic) = 
a m(n - 1 '>a(s'. basic) = a m( - n ^>- 2 a(s'. basic) = a ml - n ^- l a{s' .basic) = a m(n \ 

P2 This condition must be shown for k = m(n) — 1 and k = m(n). 

As for the previous cases, it is easy to see that J m ( n )- 2 = XI m< - n )~ l . Then the 
result for k = m(n) — 1 directly follows from case 2 of the definition of R( g j). 
Similarly, X m ( n )- 1 = aX m ("). Furthermore, g(a m ( n ~ 1 \ a) = s' .basic which im- 
plies g(a m ( n ) -2 , a) = g(a m ( n ) _1 , a) = s' . basic. Now the result for k = m(n) 
follows from case 3 of the definition of R( g j). 

Case 4.2 Assume / p (S n_1 ) = (u,b,s) 
Define: a m ^ = a" 1 '"'" 1 a(s' .basic) 

PI untime(Yi n ) = wn£«'rae(X n_1 ~ a/a{s'}) = untime(T, n ~ 1 )a(s' .basic) = 

a m{n - r hi(s' .basic) = a" 1 '"'" 1 a(s' .basic) = a m{n \ 
P2 This condition must be shown for k = m(n). 

Since I™^)" 1 = al m ^ and g(a m{n - l \a) = g(a m{n ^- l ,a) = s'. basic, the result 

follows from case 3 of the definition of R( g j). 

Case 5 In this case (S n ,I p n ) = (E"- 1 ,!^ -1 ). 

Define: a" 1 ^ = a" 1 '"'" 1 

PI The induction hypothesis and the definition of m(n) imply that untime(T, n ) = 
untimeiT,"- 1 ) = a" 1 '"" 1 ' = a" 1 '"'" 1 = a m{n \ 
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P2 This condition must be shown for k = m(n). 

By definition of (X n ) n>0 , there exists an n' < n such that T," is finite, f p (T," ) = u, 
for some u, and S n ' +1 ~= S n '+ 2 = • • • = S"" 1 = S n = S n ' ~ u. 

Then Definition 5.6 of (g p ,f p ) implies that f(untime(T, n )) = _L and then, since 
untime(Y< n ) = untime(T 1 n ~ 1 ), f (untime(T 1 n ~ 1 )) = _L. Thus, by the induction hy- 
pothesis and definition of ra(n), /(a™ 1 ™ -1 )) = /(a™ 1 ™) -1 ) = _L, 
By definition of X~ m{n \ j™(«)-i = j _ j-(m(n)-i) = A(I-I" m ( n )) = AI m ( n ). 
Now, since a m ^ = a" 1 '"'" 1 , /(a" 1 '"'" 1 ) = _L, and I™^)" 1 = \X m{n \ the result 
follows from case 2 in the definition of R( g j) (cf. Definition 3.12). 

This concludes the inductive definition and proof. By P2 and the fact that lim n ^oo m(n) = oo, 
(a n ,X n ) n>00 is the outcome sequence of (g,f) given untime(T,) and I. Now, 

untime(Yi') = untime (lim n ^oo S n ) 

= ]im. n _, 00 (untime(Yl n )) 

= Um„^ 00 a m (") 

= lim^oo a n 

= 0(gj^(untime(Y<),T) 
where step 1 follows from the definition of £', step 2 follows from continuity of untime (easy 
to verify), step 3 follows from PI in the induction proof, step 4 follows from the fact that 
lim n ^oo m(n) = oo, and finally step 5 follows from the fact that (a n ,X n ) n>00 is the outcome 
sequence of (g,f) given untime(T,) and X. This concludes the proof. ■ 

Lemma 5.9 

Let A be a safe I/O automaton with v ^ acts(A) and let (g,f) be an (untimed) strategy 
defined on A. Let A p = patient(A) and (g p , f p ) = patient s (g, /) for some arbitrary positive 
real number 8. Let X G t-exec* (A p ) be an arbitrary finite timed execution of A p , X an arbitrary 
timed environment sequence for A p compatible with X, and £' an arbitrary timed execution of 
the outcome (9( 3 j )(£,!). Then for any two elements (ai,ii) and (a 2 ,t 2 ) in t-seq(T,' — X) \ 
(local(A p ) x T), \t 2 — h\> 6. 

Proof. Let (ai,ii) and (a 2 ,t 2 ) be two arbitrary pairs in 7 = t-seq(T,' — X) \ (local(A p ) X T) 
and assume, without loss of generality, that (ai,ii) occurs before (a 2 ,t 2 ) in 7. This implies 
that t 2 > ti. Furthermore, assume, again without loss of generality, that (ai,ii) and (a 2 ,t 2 ) 
are consecutive in 7. Let (X n ,Z n ) n>0 be an outcome sequence of (g p , f p ) given X and I such 
that X' = lim n ^oo X n . 

Definition 4.17 now implies the existence of a number n such that (a 2 ,t 2 ) is not in t-seq(T, n — 
X) t(/oca/(A p ) X T) and X n+1 = X n ~wa 2 {s} with / p (S n ) = (u,a 2 ,s) and Itime(uj) = t 2 . Also, 
(ai,ii) must be in t-seq(T, n — X) [" (local(A p ) X T) since otherwise it could not occur before 
(a 2 ,t 2 ) in 7. Let i ( = lloctime(T, n ) . Since a! G local(A p ), t x < i;. 

By definition of / p (Definition 5.6), Itime(uj) = max(ltime(T, n ), lloctime(T, n ) + <*)). Thus, 
t 2 = Itime(uj) > t\ + 8 > ii + <*>, or equivalently, t 2 — ti > 8. That suffices. ■ 
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It is now possible to prove that for any environment-free strategy (g, /) for a live I/O automaton 
(A,L) and any positive 8, patient s (g, /) is an environment-free (timed) strategy for (A p ,L p U 
t-exec zt (A p )), where (A p ,L p ) = patient(A,L). 

Lemma 5.10 

Let (A, L) be a live I/O automaton with v ^ acts(A) and let (g, /) be an (untimed) environment- 
free strategy for (A,L). Furthermore, let (A p ,L p ) = patient(A,L). Then, for any positive real 
number 8, patient 6 (g, f) is a (timed) environment-free strategy for (A p ,L p U t-exec zt (A p )). 

Proof. Let 8 be an arbitrary positive real number and let (g p , f p ) = patient s (g, /). Note that 
by Lemma 5.7 (g p , f p ) is a (timed) strategy defined on A p . By Definition 4.22 one must show 
that 

1. A p is a safe timed I/O automaton, 

2. L p U t-exec zt (Ap) C t-exec(A p ), 

3. (9( 3 j )(£,2p) C L p U £-e;rec z *(Ap), for all X G t-exec*(A p ) and all timed environment 
sequences X v for A p compatible with S, and 

4. (<7 p , / p ) is Zeno-tolerant. 
Consider the points one at a time. 

1. Definition 5.1 directly implies that A p is a safe timed I/O automaton. 

2. By Definition 5.4, L p C t-exec 00 ( A p ) and since also £-e;rec z *(Ap) C t-exec(A p ), the result 
follows. 

3. Let S G t-exec* (Ap) be an arbitrary finite timed execution of A p and I p be an arbitrary 
timed environment sequence for A p compatible with S. Let £' G (9( 3 j )(£,X P ) be an 
arbitrary element of the outcome. By Lemma 4.18, S is either Zeno or admissible. 

• Assume £' is Zeno. 

Then, by Lemma 5.9 there are only finitely many locally-controlled actions of A p in 
£'. Now, Lemma 4.18 implies that £' contains infinitely many input actions. Thus, 
S G £-e;rec z *(Ap). That suffices. 

• Assume £' is admissible. 

By Lemma 5.8 there exists an environment sequence I for A such that untime(T,') = 
0( g j^(untime(Y<) ,1) . The fact that (g, /) is an environment-free strategy for (A, L) 
implies untime(T, r ) G L. This implies, by Definition 5.4, that £' G £ p . That suffices. 

4. To prove that (g p , f p ) is Zeno-tolerant (cf. Definition 4.21), it suffices to note that the 
previous case implies the following. For arbitrary S G t-exec* (A p ) and arbitrary timed 
environment sequences J p for A p compatible with S, (9( 3 j )(£,X P ) C£ p U £-e;rec z *(Ap), 
where i p C t-exec°°(A p ) by Definition 5.4. ■ 
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Finally, we can prove that for any live I/O automaton (A, L), patient(A, L) is a live timed I/O 
automaton. 

Proposition 5.11 

Let (A, L) be a live I/O automaton. Then patient(A, L) is a live timed I/O automaton. 

Proof. Let (A p ,L p ) = patient(A,L). Definition 5.1 implies that A p is a safe timed I/O 
automaton. Furthermore, L C t-exec°°(A p ) by Definition 5.4. Finally, Lemma 5.10 implies 
that the pair (A p ,L p U t-exec zt (A p )) is environment-free. By Definition 4.23, this suffices. ■ 

Now attention is turned to proving the Embedding Theorem, which states that the safe and 
live preorders of live I/O automata are preserved by the patient operator. A few preliminary 
lemmas are needed. 

Lemma 5.12 

Let A be a safe I/O automaton with v ^ acts(A) and let A p = patient(A) . Furthermore, let 

X G t-exec(A p ). Then, 

untime(t-trace A (£)) = trace A (untime(T,)) 

Proof. Let S = uj aiUJia 2 ijJ2 • • •• 

Then, t-trace A (S) = ((a 1 ,/^'me(cj 1 ))(a 2 ,/^'me(cj 2 )) • • • \{vis(A p ) X T), ltime(T,)) and it follows 
that untime(t-trace A (£)) = ai«2 • • • \ vis(A p ). 

Now, untime(T,) = (fstate(uj ) .basic)ai(fstate(uji) .6as«c)a 2 (/state(cj 2 ) .basic) ■ ■ ■ and it follows 
that trace A (untime(T,)) = a^a^ • • • \ ext(A). 

By Definition 5.1, vis(A p ) = ext(A), so the result follows. ■ 

Lemma 5.13 

Let (A,L) be a live I/O automaton with v ^ acts(A). Then, 

1. If "l G t-traces(patient(A)) then untime(j) G traces(A). 

2. If (3 G traces(A) and 7 G tsp(ext(A)) with (3 = untime(j) such that if seq(j) is Zeno, 
then Itime(j) is the limit of the times in seq(j), then 7 G t-traces(patient(A)). 

3. If 7 G t-traces( patient A (L)) then untime(j) G traces(L). 

4- If fi G traces(L) and 7 G tsp(ext(A)) is admissible with (3 = untime(j) , then 7 G 
t-traces(patient A (L)). 

Proof. Let (A p ,L p ) = patient(A,L). Consider the four parts separately. 
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1. Let 7 G t-traces(A p ) and X G t-exec(A p ) such that t-trace(T,) = 7. Then untime(j) = 
untime(t-trace(Y<)) which, by Lemma 5.12, equals trace(untime(T,)). By Lemma 5.3, 
untime(Yi) G exec(A). That suffices. 

2. Let /3 = a 1 a 2 a 3 • • • G £races(A) and 7 G £sp(e;r£(A)) such that (3 = untime(j). Thus, 
7 = ((a 1 , i 1 )(a 2 , i 2 )(a 3 , i 3 ) • • • , i/) for nondecreasing times i 1 , i 2 , i 3 , . . . and time i; (possibly 
00) greater than or equal to t for all i in 7. Also, let a = s ais 1 a 2 s 2 • • • G exec(A) such 
that /3 = trace(a) and a is finite if (3 (and thus seg(7)) is finite. 

By definition of trace, each external action a, in a corresponds to an action a J (= a,) in 
/3 and thus a pair (a\V) in seq(j). Define i J to be the time of occurrence i, of a,. For 
internal actions a, in a, define the time of occurrence i, to be the time of occurrence of 
the previous external action in a or if no such action exists. Define, if a is finite with 
a n being its last action, t n+ i = t\ (possibly 00). 

Now, define X = uj aiUJia 2 ijJ2 • • • where dom(uj ) = [0, ii], rng(uj ) = {(s ,t) \ t G 
dom(uj )}, dom(uji) = [i l5 i 2 ], rng(uji) = {(si,i) | t G dom(uji)}, and dom(uj 2 ) = [^27^3], 
rng{u2) = {( s 2^) \ t G dom(uj 2 )}- Then clearly, by Definition 5.1, X G t-exec(A p ), and 
furthermore t-trace(T,) = (seq(j), ltime(T,)). (Note, that vis(A p ) = ext(A).) 

If a is finite, then, depending on i ( , X is admissible or finite, but in both cases ltime(T,) = 

h- 

If a is infinite, then seq(j) is infinite and 

(1) if seq(j) is Zeno, then ltime(T,) equals the limit of the times in seq(j), which equals 
ti by assumption, and 

(2) if seq(j) is admissible, then X is admissible. 

Thus, in all cases ltime(T,) = i ( . Finally, conclude that t-trace(T,) = 7 which implies that 
7 G t-traces(A p ) as required. 

3. Let 7 G t-traces(L p ) and X G L p such that t-trace(T,) = 7. Then untime(j) = 
untime(t-trace(Y<)) which, by Lemma 5.12, equals trace(untime(T,)). Definition 5.4 and 
the fact that X G L p imply that untime(T,) G L. That suffices. 

4. This proof is similar to the proof of Part 2 except that a is chosen from L and thus 
might be infinite even though (3 is finite. If this is the case the times of occurrence of the 
internal actions in the diverging suffix of a are chosen to increase by some fixed amount, 
say, 1. Then X is admissible, and clearly a = untime(T,), so by Definition 5.4, X G L p . 
Thus, 7 G t-traces(L p ). ■ 

Theorem 5.14 (Embedding Theorem) 

Let (A,L) and (B,M) be live I/O automata with v ^ (acts(A) U acts(B)). Then 

1. (A,L) C s (B,M) iff patient(A, L) C st patient(B,M). 

2. (A,L) C L (B,M) iff patient(A, L) C Lt patient(B,M). 
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Proof. Let (A p ,L p ) = patient(A, L) and (B p ,M p ) = patient(B,M). The two parts of the 
lemma are considered separately. 

1. =X Let 7 £ t-traces(A p ) . By Lemma 5.13 Part 1, (3 = untime(j) £ traces(A), which 
implies, since (A,L) C s (B,M), that (3 £ traces(B). Now, the fact that 7 is a timed 
sequence pair over vis(A p ) = vis(B p ) = ext(B) and the fact that 7 satisfies the property 
seq(j) being Zeno implies Itime(j) is the limit of the times in seq(j), Lemma 5.13 Part 2 
implies that 7 £ t-traces(B p ), as required. 

^=: Let (3 £ traces(A) and let 7 be any, say, admissible timed sequence pair over 
ext(A) such that untime(j) = (3. (Such a timed sequence pair clearly exists.) Then, 
by Lemma 5.13 Part 2, 7 £ t-traces(A p ) . Thus, the assumption that patient(A, L) C st 
patient(B,M) implies 7 £ t-traces(B p ). Lemma 5.13 Part 1 shows that (3 = untime(j) £ 
traces(B), as required. 

2. Similar to Part 1 by using Lemma 5.13 Parts 3 and 4. ■ 

Finally we prove a result which is important when doing specification and verification in a 
modular fashion. Namely, the patient operator commutes with the three operators on safe and 
live (timed) I/O automata. First, let = st and = Lt denote the kernels of the preorders C st and 
C Lt , respectively. 2 

Proposition 5.15 

Let (A, L) and (Ai, Li), . . ., (A N , L N ) be live I/O automata and let = x be one of = st and = Lt . 

1. Let (Ai, Li), . . . , (A N , L N ) be compatible. Then, 

patient((Ai, Li)\\ ■ ■ ■ \\(A N , L N )) = x patient(Ai, Li)\\ ■ ■ ■ \\patient(A N , L N ) 

2. Let A C local(A). Then, 
patient((A, L) \ A) = x patient(A, L)\A 

3. Let p be an action mapping applicable to A and let p v be p extended with the mapping 
\y I— ► v\. Then, 

patient(p(A, L)) = x p v (patient(A, L)) 

Proof. We show the proofs for = st . The proofs for = Lt are similar. 

1. First note that since (A l7 Li), . . ., (A N , L N ) are compatible, then also patient (Ai, Li), 
. . . , patient(A N , L N ) are compatible. 



2 The kernel of a preorder C is defined to be the equivalence = defined hy x = y = iCjAjCi. 
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Observe the simple fact that for each timed execution X, untime(T,)\Ai = untime(T,\Ai 
Then, 



X £ t-exec(patient(Ai\ 
iff untime(Yi) £ exec(Ai\\ 



Un)) 
\An) 



iff 
iff 



Vi<i<jv 
Vi<i<jv 



iff Vl<i<N 

iff X £ t-exec(patient(Ai 



untime(Y<)\Ai £ exec(Ai) 
untime(Y<\Ai) £ exec(Ai) 
T<\Ai £ t-exec(patient(Ai)) 



Lemma 5.3 
Lemma 3.5 
observation above 
Lemma 5.3 



• \\patient(A N )) Lemma 4. ff 



That suffices. 
2. Note that since A C local(A), also A C local(patient(A)) . Then, 





S £ t-exec(patient(A \ A)) 




iff 


untime(Yi) £ exec(A \ A) 


Lemma 5.3 


iff 


untime(Yi) £ exec(A) 


Lemma 3.7 


iff 


S £ t-exec(patient(A)) 


Lemma 5.3 


iff 


S £ t-exec(patient(A) \ A) 


Lemma 4.f3 


That suffi 


ces. 





3. First note that since /> is applicable to A, p v is applicable to patient(A). Also note that, 
since each renaming function p is injective, there is an inverse function p~ x : p(dom(p)) —^ 
dom(p) such that /0 _1 (6) is the unique a satisfying p(a) = b. 

Observe the simple fact that for any timed execution S and any rename function p', 
p'(untime(Y<)) = untime(p' v (T,)), where p' v is obtained from p' by adding the mapping 
\v I— ► v\. Then, 



S £ t-exec(patient(p(A)) 
iff untime(Yi) £ ea;ec(p(A)) 
iff p~ 1 (untime(Y<)) £ exec(A) 
iff untime(p~ l ■(£)) £ exec(A) 
iff / o~ 1 (S) £ t-exec(patient(A)) 
iff S £ t-exec(p(patient(A))) 



Lemma 5.3 
Lemma 3.9 
observation above 
Lemma 5.3 
Lemma 4.15 



That suffices. 



6 Proof Techniques 

This section presents a number of techniques to prove the safe preorder and the live preorder 
on live (timed) I/O automata. The techniques are based on results in [LV93a]([LV93b]), which 
show that several simulation relations between (timed) automata are sound with respect to 
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the safe preorder. This section also shows that a stronger result, called the Execution Corre- 
spondence Theorem, can be proven for the simulations of [LV93a]([LV93b]). Specifically, that 
there is a certain correspondence between the executions of the involved automata and not 
only between their traces. In the untimed model, liveness conditions of live I/O automata are 
stated in terms of executions and not in terms of traces, thus the Execution Correspondence 
Theorem can form the basis for proofs of the live preorder. In the timed model, where liveness 
conditions are given in terms of timed executions, the timed version of Execution Correspon- 
dence Theorem along with a sampling characterization of the live timed executions is used as 
the basis for proofs of the live preorder. 

The proof that a live (timed) I/O automaton A implements (based on the live preorder) 
another live (timed) I/O automaton B consists of two main steps. First a simulation relation 
between the safe (timed) I/O automata parts is proven. Because of the soundness of the 
simulation relations with respect to the safe preorder(s), the simulation relation already implies 
that the safe preorder(s) holds. The second step, which is described in detail in this section, 
uses the simulation relation found in the first step and the Execution Correspondence Theorem 
to prove the live preorder. 

Ideas similar to those of the Execution Correspondence Theorem appear in the soundness 
proofs of the simulations for the safe preorder given in [LT87, LV93a]. The contribution of this 
section is to formally state and prove the Execution Correspondence Theorem for a large class 
of simulations and to show how it can be used as the basis for proving the live preorder. 

Several pragmatic considerations support the approach to verification taken in this section. 
For example, when proving the safe and live preorders in the untimed setting, it is often difficult 
to reason directly about the traces of the involved live I/O automata. In particular, the traces 
of an automaton are defined implicitly as the traces of the executions of the automaton, and 
the liveness condition of a live automaton is usually defined implicitly to be a set of executions 
of the automaton that satisfy certain properties, typically specified in some temporal logic. 
Thus, the sets of traces and live traces are not directly available. Rather, they are derived 
from automata, temporal logic formulas, etc. As a result, simulation based proof techniques 
which use the information available directly, e.g., automata, and which are sound with respect 
to the safe and live preorders, are attractive. 

Furthermore, using our proof methodology, the main complexity of a correctness proof for 
the safe and live preorders is found in the simulation proof. Fortunately, simulation proofs have 
a nice case structure that scales well to large examples and provides good intuitive insight into 
the automata for which the simulation relation is being proven. Another practical advantage of 
our proof methodology for the live preorder is that it proves the safe preorder as a side result. 
The work in [SLL93, LLS93] shows why this can be useful. In [SLL93, LLS93] the five-packet- 
handshake protocol of [Bel76] is shown to guarantee a safety property of "at-most-once message 
delivery", as well as liveness properties such as "in the absence of crashes, each message will 
eventually be delivered". However, the liveness of the system depends on liveness assumptions 
on the channels connecting the sender and the receiver: "if a packet is sent infinitely often 
then it will be received infinitely often". This liveness assumption must hold even though the 
channels are allowed to lose packets. However, if the channel is cut, then correctness as defined 
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Specification Level • ►-• ►-• ►-• ►-• ►-• • • • 

Simulation Relation / / 

t a / t 5 \ / 

Implementation Level • ►-• ►-• ►-• ►-• ►-• • • • 

Figure 2: Example of a simulation. The actions a and b are external actions. The remaining 
steps represent internal actions. 



by the live preorder is no longer ensured. Fortunately, since the safety property is independent 
of the liveness of the channel, safety is still guaranteed, i.e., no message is delivered more than 
once. 

6.1 Untimed Proof Techniques 

Section 6.1.1 defines a number of simulation relations taken from [LV93a]. Section 6.1.2 presents 
the Execution Correspondence Theorem. Finally, Sections 6.1.3 and 6.1.4 deal with proving 
the safe and live preorders, respectively. 

6.1.1 Simulation Proof Techniques 

This section presents simulation relations taken from [LV93a]. For the purpose of generality, 
the definitions are stated in terms of automata. All results are also valid for the special case 
of safe I/O automata. 

A simulation relation is a relation between the states of one automaton, called the concrete, 
low-level, or implementation automaton, and the states of another automaton, called the 
abstract, high-level, or specification automaton, such that certain properties hold. The exact 
properties depend on the type of simulation (forward, backward, etc.) but they generally 
consist of two properties. First, the start states of the two automata must be related in a 
certain way, and, second, each step of the implementation automaton must "correspond" to a 
sequence of steps of the specification automaton. 

The second property is depicted in Figure 2. For each step of the implementation au- 
tomaton, i.e., for each concrete step, there must exist a sequence of (abstract) steps of the 
specification automaton between states related — by the simulation relation — to the pre- and 
post-state of the considered concrete step, such that the sequence of abstract steps contains 
exactly the same external actions as the concrete step. How the sequence of abstract steps is 
selected depends on what type of simulation is considered. 

Below forward simulations, refinement mappings, backward simulations, history relations, 
and prophecy relations are defined. The definitions are similar to the definitions given in 
[LV93a] where combinations of forward and backward simulations are also considered. The 



79 



reader is referred to [LV93a] for details about, e.g., partial completeness of the simulation 
techniques. 

The simulation techniques use invariants (and are thus called weak in [LV93a]) of the 
implementation and specification automata to restrict the steps which need to be considered. 
Define an invariant of an automaton to be any set of states of the automaton that is a superset 
of the reachable states of the automaton. Equivalently, an invariant could be defined to be a 
state predicate that is satisfied for all reachable states of the automaton. 

We use the following notational convention: if R is a relation over Si X S 2 and Si G Si, 
then R[si] denotes the set {s 2 G S 2 \ (si,s 2 ) G R}. 

Definition 6.1 (Forward simulation) 

Let A and B be automata with the same external actions and with invariants I A and I B , 
respectively. A forward simulation from A to B, with respect to I A and I B , is a relation / over 
states(A) X states(B) that satisfies: 

1. If s G start(A) then f[s] l~l start(B) ^ 0. 

2. If (s,a,s r ) G steps(A), s,s' G I a, an d u G f[s] P\ I B , then there exists an a G frag*(B) 
with fstate(a) = u, Istate(a) G f[s'], and trace(a) = trace(a). 

Write A < F B if there exists a forward simulation from A to B with respect to some invariants 
I a and I B . If / is a forward simulation from A to B with respect to some invariants I A and 
I B , write A < F B via /. ■ 

A refinement mapping is a special case of a forward simulation where the relation is a function. 
Because of its practical importance (cf. [AL91a]) an explicit definition is given. 

Definition 6.2 (Refinement mapping) 

Let A and B be automata with the same external actions and with invariants I A and I B , 
respectively. A refinement mapping from A to B, with respect to I A and is, is a function r 
from states(A) to states(B) that satisfies: 

1. If s G start(A) then r(s) G start(B). 

2. If (s,a, s') G steps(A), s,s' G /a, and r(s) G i#, then there exists an a G frag*(B) with 
fstate(a) = r(s), Istate(a) = r(s'), and trace(a) = trace(a). 

Write A < R B if there exists a refinement mapping from Ato B with respect to some invariants 
I a and I B . If r is a refinement mapping from A to B with respect to some invariants I A and 
i#, write A < R B via r. ■ 

In a forward simulation there has to be a sequence of abstract steps starting from any of the 
abstract states related to the concrete pre-state (restricted to the invariant) and ending in 
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some state related to the concrete post-state. The word "forward" thus refers to the fact that 
the abstract sequence of steps is constructed from any possible pre-state in a forward direction 
toward the set of possible post-states. 

In a backward simulation, on the other hand, there has to be a sequence of abstract steps 
ending in any state related to the concrete post-state (restricted to the invariant) and starting 
in some state related to the concrete pre-state. In other words, the sequence of abstract steps 
is constructed given a post-state rather than a pre-state as in the forward simulation. Thus, 
in a backward simulation the steps are constructed in a backward direction. 

We need the following definition of image-finiteness for the definition of a backwards sim- 
ulation. A relation R over Si X S 2 is image-finite if for each Si G Si, R[si] is a finite set. 

Definition 6.3 (Backward simulation) 

Let A and B be automata with the same external actions and with invariants I A and I B , 
respectively. A backward simulation from A to B, with respect to I A and I B , is a relation b 
over states(A) X states(B) that satisfies: 

1. If s G I A then b[s]f]I B ^ 0. 

2. If s G start(A) then b[s] l~l I B C start (B). 

3. If (s,a,s r ) G steps(A), s,s' G I A , and u' G b[s'] P\ I B , then there exists an a G frag*(B) 
with Istate(a) = u' , fstate(a) G b[s] P\ I B , and trace(a) = trace(a). 

Write A < B B if there exists a backward simulation from A to B with respect to some invariants 
I a and I B . Furthermore, if the backward simulation is image-finite, write A < iB B. If b is a 
backward simulation from A to B with respect to some invariants I A and I B , write A < B B 
(or A < iB B when b is image-finite) via b. ■ 

In [LV93a] abstract notions of history variables [OG76] and prophecy variables [AL91a] are 
given in terms of history relations and prophecy relations. 

Definition 6.4 (History relation) 

Let A and B be automata with the same external actions and with invariants I A and I B , 
respectively. A relation h over states(A) X states(B) is a history relation from A to B, with 
respect to I A and J B , if h is a forward simulation from A to B with respect to I A and J B , and 
h~ x is a refinement mapping from B to A, with respect to I B and i^. 

Write A < H B if there exists a history relation from A to B with respect to some invariants 
I a and J B . If h is a history relation from A to B with respect to some invariants I A and I B , 
write A <# i? via h. ■ 

Definition 6.5 (Prophecy relation) 
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Let A and B be automata with the same external actions and with invariants I A and I B , 
respectively. A relation p over states(A) X states(B) is a prophecy relation from A to B, with 
respect to I A and J B , if p is a backward simulation from A to B with respect to I A and J B , 
and p _1 is a refinement mapping from B to A, with respect to I A and J B . 

Write A < P B if there exists a prophecy relation from A to B with respect to some invariants 
I a and J B . Furthermore, if the prophecy relation is image-finite, write A < iP B. If p is a 
prophecy relation from A to B with respect to some invariants I A and I B , write A <p _B (or 
A < iP B when p is image-finite) via p. ■ 

6.1.2 Execution Correspondence 

This subsection introduces and proves the Execution Correspondence Theorem (ECT). The 
ECT states that if any of the simulations defined in the previous section has been proven 
from an implementation automaton to a specification automaton, then for any execution of 
the implementation automaton, there is a "corresponding" execution of the specification au- 
tomaton. In order to formalize this notion of correspondence, the notions of R-relation and 
index mapping are introduced. 

Definition 6.6 (i?-relation and index mappings) 

Let A and B be automata with the same external actions and let R be a relation over 
states(A) X states(B). Furthermore, let a and a' be executions of A and B, respectively: 

a = s ais 1 a 2 s 2 • • • 
a' = u biUib 2 u 2 ■ ■ ■ 

Say that a and a' are R-related, written (a, a') £ R, if there exists a total, nondecreasing 
mapping m : {0, 1, . . ., \a\} — ► {0, 1, . . ., |a'|} such that 

1. m(0) = 0, 

2. (si,w m (i)) G R for all < i < \a\, 

3. £race(& m (;_i) + i • • -b m ^) = trace(ai) for all < i < \a\, and 

4. for all j, < j < \a'\, there exists an i, < i < |a|, such that ra(i) > j. 

The mapping to is referred to as an index mapping from a to a' with respect to i?. 

Write (A, B) £ i? if for every execution a of A, there exists an execution a 1 of i? such that 
(a, a') e R. ■ 

Thus, an index mapping maps indices of states in the concrete execution to indices of states in 
the abstract execution. Effectively, an index mapping maps concrete states to corresponding 
abstract states in such a way that the start states correspond (Condition 1), corresponding 
states are related by R (Condition 2), and the external actions between two consecutive pairs 
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of corresponding states are the same at the concrete and the abstract level (Condition 3). 
Condition 4 ensures that the abstract execution (a 1 ) is not "too long", i.e., a 1 must not extend 
beyond the last state of a' corresponding to some state in a (if such a state exists). Note, that 
if a is finite, then a 1 must also be finite. However, even if a is infinite, a 1 can be finite if the 
index mapping is constant for indices above some bound. 

In order to prove the ECT, two auxiliary lemmas are needed. The first, Lemma 6.7, deals with 
forward simulations; the second, Lemma 6.10, deals with backward simulations. 

Lemma 6.7 

Let A and B be automata with the same external actions and assume A < F B via f. Fur- 
thermore, let a be an arbitrary execution of A. Then there exists a collection (a'-, ra;) <i<|a| of 
finite executions of B and mappings such that 

1. mi is an index mapping from a\i to a'- with respect to f, for all < i < \a\, and 

2. a' i _ l < a'- and nii_i = nii \ {0, . . ., i — 1}, for all < i < \a\. 

Proof. Let a = s ais 1 a 2 s 2 • • • and let I A and L B be invariants of A and B, respectively, such 
that / is a forward simulation from A to B with respect to I A and L B . Construct a'- and to, 
inductively. 

Since s £ start(A), Condition 1 of Definition 6.1 of a forward simulation gives the existence 
of a state u £ start(B) such that (s ,u ) £ /. Let a' = u and let m be the mapping that 
maps to 0. Then clearly m is an index mapping from a| to a' with respect to /. 

Now assume nii_i (for < i < \a\) is an index mapping from a|j_i to a' i _ l with respect to /. 
Let u = /state(a'_ 1 ). Then, by definition of ra;_i, m J _ 1 (i — 1) = \a' i _ 1 \ and (s;_i,w) £ /. Since 
(si_i,a,i,Si) £ steps(A), and Sj_i, s,, and u are are reachable (by definition since they occur 
in an execution) and therefore satisfy their respective invariants, Condition 2 of Definition 6.1 
(Forward simulation) gives the existence of a finite execution fragment a" of B which starts 
in u and ends in a state u' with (s 8 ,m') £ /, such that trace(a") = trace(ai). Now define 
a j- = «'■_! ~ a" and define to, to be the mapping such that m 8 (j) = m,i_i(j) for all < j < i — 1 
and mi(i) = \a'A. Then, to, is trivially an index mapping from a\i to a'- with respect to /, and 
Part 2 of the lemma holds by construction. ■ 

In order to state an analogous lemma for backward simulations, the notion of induced digraph 
is introduced along with some lemmas giving properties of the induced digraph. 

Definition 6.8 (Induced digraph) 

Let A and B be automata with the same external actions and assume A < iB B via b with 
respect to some invariants I A and I B . For any execution a = s ais 1 a 2 s 2 • • • of A, let the 
digraph induced by a, b, and I B be the digraph G constructed as follows: 

• The nodes of G are the pairs (u, i) where < i < \a\ and u £ 6[s 8 ] n I B . 
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• There is an edge from (u, i) to (u 1 , i 1 ) exactly if i 1 = i-\-l and there exists a finite execution 
fragment a' of B such that fstate(a') = u, Istate(a') = u' , and trace(a') = trace(a i+ i). ■ 

Lemma 6.9 

Let A and B be automata with the same external actions and assume A < iB B via b with 
respect to some I A and I B . Furthermore, let a be any execution of A. Then the digraph G 
induced by a, b, and L B satisfies: 

1. For each < i < \a\, there are nodes of the form (u, i). 

2. Exactly all nodes of the form (u, 0) are roots. 

3. G has finitely many roots. 

4- Each node of G has finite outdegree. 

5. Each node of G is reachable from some root of G. 

Proof. Let a = s ais 1 a 2 s 2 • • •. 

1. Since each state s, in a is reachable (by definition) and thus belongs to I A , Condition 1 of 
Definition 6.3 (Backward simulation) gives us that b[si]P\lB j^ 0- Thus, by Definition 6.8, 
G has nodes of the form (u, i). 

2. Any node (u, 0) is a root in G. Consider any node (u, i) with i > 0. Then since u £ 
b[si] fl Ib, Si_i,Si G Ia, and (sj_i,a;,Sj) G steps(A), Definition 6.3 implies the existence 
of a finite execution fragment a' of B with Istate(a) = u, trace(a') = trace(ai), and 
fstate(a) G b[si_i]P\lB- Then by Definition 6.8 there is an edge in G from (fstate(a), i — 1) 
to (u,i). Thus, (u,i) is not a root in G. 

3. Since b is image-finite, the set b[s ] H Is is finite and the result follows. 

4. From any node (u,i), there can only be edges to nodes of the form (u',i + 1). Again, 
since b is image-finite, there are only finitely many such nodes. 

5. Any node of the form (u, 0) is reachable. Assume all nodes of the form (u, i) are reachable 
(for some < i < \a\). By an argument similar to Point 2 above, it is seen that to any 
node of the form (u 1 , i + 1), there is an edge from a node of the form (u, i). Thus, any 
node of the form (m', i + 1) is reachable. By induction all nodes of G are reachable. ■ 

Lemma 6.10 

Let A and B be automata with the same external actions and assume A < iB B via b. Fur- 
thermore, let a be an arbitrary execution of A. Then there exists a collection (a'., mi) 0<i< \ a \ of 
finite executions of B and mappings such that 

1. mi is an index mapping from a\i to a'- with respect to b, for all < i < \a\, and 
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2. a'i_i < a'i and rrii_i = to, \ {0, . . ., i — 1}, for all < i < \a\. 

Proof. Let a = s ais 1 a 2 s 2 • • • and let I A and I B be invariants of A and B, respectively, 
such that b is an image-finite backward simulation from A to B with respect to I A and I B . 
Furthermore, let G be the digraph induced by a, b, and I B . If a is finite, fix p to be any path 
(w , 0)(«i, 1) • • ■(«„, ra), where n = \a\. Such a path exists by Condition 5 of Lemma 6.9. If a 
is infinite, then G is infinite and Lemmas 6.9 and 2.1 (Konig's Lemma) imply the existence of 
an infinite path in G. Fix p = (u , 0)(m 17 1) • • • to be any such path. Now construct a', and to, 
inductively. At the same time prove that /state(a') = m,. 

Since s £ start(A) and u £ b[s ] n i#, Condition 2 of Definition 6.3 of a backward 
simulation implies that u £ start (B). Let a' = m and let m be the mapping that maps to 
0. Then clearly m is an index mapping from a| to a' with respect to 6, and lstate(a' ) = u . 

Now assume TOj_! (for < i < \a\) is an index mapping from a|j_i to a' i _ l with respect to 
b and assume that Istateia'^^ = Ui_i. Since there is an edge in G from (ui_i,i — 1) to (ui,i), 
there exists, by Definition 6.8, a finite execution fragment a" of i? such that fstate(a") = ti;_i, 
lstate(a") = Ui, and trace(a") = trace(ai). Now define a'- = a'-^ ~ a" and define to, to be the 
mapping such that m 8 (j) = mi_i(j) for ah < j < i — 1 and m 8 (i) = |a'|. Then, trivially 
TO, is an index mapping from a\i to a'- with respect to 6, and Point 2 of the lemma holds by 
construction. Also, /state(a') = m, as required. 

If a is finite, then the lemma holds by construction; if a is infinite, then the lemma holds 
by induction. ■ 

Finally, the Execution Correspondence Theorem can be stated and proven. The theorem states 
that if a relation S is a forward simulation, refinement mapping, image-finite backward simu- 
lation, history relation, or image-finite prophecy relation from A to B, then for any execution 
of A, there exists an 5-related execution of B. 

Theorem 6.11 (Execution Correspondence Theorem) 

Let A and B be automata with the same external actions. Assume for X £ {F,R,iB,H,iP} 
that A< x B via S. Then (A,B) £ S. 

Proof. One must show that for all a £ exec(A) there exists an a 1 £ exec(B) such that 
(a, a') £ S. Consider cases. 

1. A< F B via S. 

Let a = s ais 1 a 2 s 2 • • • be an arbitrary execution of A, and let (a'-, mi) 0<i< \ a \ be a collec- 
tion of finite executions of B and mappings as defined in Lemma 6.7. 

First assume a is finite. Then a = a||„|, and according to Lemma 6.7 m\ a \ is an index 
mapping from a|| a | to af, . That suffices since a(, = a' by Condition 4 of Definition 6.6 

Now, assume a is infinite. Then let m be the unique mapping over the natural numbers 
defined by m(i) = m 8 (i), and let a 1 be the limit of a'- under the prefix ordering. Thus, 
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a 1 is the unique execution of B defined by a'\ m ^ = a'- with the restriction that for any 
index j of a' there exists an i such that a'\j < a'-. 

Now the claim is that m is an index mapping from a to a' with respect to S. First 
note that m is total and nondecreasing. The latter is seen by contradiction. Assume 
m is not nondecreasing. Then there exists an i such that m(i) < m(i — 1), but since 
m(i) = rrii(i) and m(i — 1) = m J _ 1 (i — 1) = m 8 (i — 1) this contradicts the fact that to, is 
an index mapping and thus is nondecreasing. Similarly, it can be seen that the range of 
m is within {0, . . ., |a'|}. 

Now the four conditions of Definition 6.6 must be checked. Condition 1 holds since m 
is an index mapping and thus satisfies to (0) = 0. Assume Condition 2 or 3 does not 
hold. Then there must exist an i such that the condition is invalidated. However, this 
contradicts the fact that for any i, rrii is an index mapping from a\i to a'- with respect 
to S. Finally, assume Condition 4 does not hold. Thus, assume the existence of an 
index j in a' such that for all i, m(i) < j. By definition of a' there exists an i such 
that a'\j < a'}. Now, Lemma 6.7 gives that m 8 (i) = |a'| > j. Thus, m(i) > j which 
contradicts the assumption that m(i) < j. 

2. A< R B via S. 

A refinement mapping is a forward simulation, so the result follows from the previous 
case. 

3. A < iB B via S . 

Same as case 1, by using Lemma 6.10 instead of Lemma 6.7. 

4. A< H B via S. 

By Definition 6.4 S is a forward simulation from A to B, so the result follows from case 
1 above. 

5. A < iP B via S . 

By Definition 6.5 S is an image-finite backward simulation from A to B, so the result 
follows from case 3 above. ■ 

6.1.3 Proving the Safe Preorder 

This subsection proves the soundness of the simulation proof techniques with respect to the 
safe preorder. This is a well-known result, see, e.g., [LV93a], however, instead of proving the 
result directly as in [LV93a], the ECT is used. We start with some preliminary definitions and 
technical lemmas needed for the proof. 

Define the ith step of a, for all < i < \a\, as step(a,i) = i_i|a|; = (sj_i,a;,Sj). Also, let 
m be a total, nondecreasing mapping m : {0, 1, . . . , N} — ► {0, 1, . . ., |a|}, where N G N U{oo}. 
Then, define the ith m-step of a, for all < i < N, as step m (a,i) = m(i-i)\ a \m(i)- 
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Lemma 6.12 

Let a be an execution fragment. 

1. Then, for all < i < j < \a\, 

{ \a\j = step(a, i + 1) ~ step(a, i + 2) ~ • • • ~ step(a,j) 

2. Let m be a total, nondecreasing mapping m : {0, 1, . . . , N} — ► {0, 1, . . . , \a\}, where N £ 
N U {oo}. Then, for all < i < j < N , 

m(i)\a\ m (j) = step m (a,i+ 1) ~ step m (a, i + 2) ~ •••~ step m (a,j) 

Proof. Trivial by explicit construction. ■ 

Lemma 6.13 

Let a be an execution fragment. 
1. Then, for all < i < \a\, 



\a 



step(a, i + 1) ~ step(a, i + 2) ~ • • • ~ step(a, \a\) if a is finite 
step(a, i + f ) ~ step(a, i + 2) ~ • • • otherwise 



#. £e£ m be a total, nondecreasing mapping m : {0, f , . . . , iV} — ► {0, f , . . . , \ot\}, where N £ 
N U {oo}, such that for all < j < \a\ there exists an i £ dom(m) with m(i) > j . Then, 
for all <i < N, 

{step m (a, i + f ) ~ step m (a, i + 2) ~ • • • ~ step m (a, iV) if iV is finite 
step m (a, i + f ) ~ step m (a, i + 2) ~ • • • otherwise 

Proof. The lemma follows from Lemma 6.12 ■ 

The following lemma is used to show that any two related executions have the same trace. 

Lemma 6.14 

Let A and B be automata with the same external actions and let R be a relation over 
states(A) X states(B). Assume that (a, a') £ R and let m be any index mapping from a 
to a' with respect to R. Then, for all < i < \a\, trace(i\a) = trace( m ^\a') . 

Proof. Let a = s ais 1 a 2 s 2 • • • and a' = u biUib 2 u 2 ■ ■ ■■ If i = \ot\ (in the case where a is 
finite), | a ||a = S| a | and Condition 4 of Definition 6.6 gives m (|„|)|a' = w m (| a |)- Thus, obviously 
trace(i\a) = trace( m ^\a r ) (the empty list). If < i < \a\, then from Lemma 6.13 

i\a = step(a,i + 1) ~ step(a,i + 2) ~ • • • 

m(i) \a' = step m (a',i+ 1) ~ step m (a' ,i + 2)~ ■■■ 
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where the concatenations are finite (and end in step(a, \a\) and step m (a' , |a|), respectively) if 
and only if a is finite. 

Now use the obvious fact that restricting an execution to a set of actions, distributes over 
concatenation. This gives us: 

trace(i\a) = (i\a) \ ext(A) 

= (step(a, i + 1) \ ext(A)) " (step(a, i + 2) \ ext(A)) 
= trace(step(a, i + 1)) " trace(step(a, i + 2)) " • • • 

trace( m{i) \a') = { m{i) \a') \ ext{B) 

= (stepja', i + 1) \ ext(Bj) " (step m (a', i + 2) \ ext(Bj) 
= trace(step m (a' , i + 1)) " trace(step m (a' , i + 2)) 

Now, from the definitions of step and step m and Condition 3 of Definition 6.6 

trace(step(a,j)) = trace(step m (a' , j)) 

for all < j < \a\. So, if |a| ^ oo, trace(i\a) = trace( m ^\a') by construction. If |a| = oo, 
assume that trace(i\a) ^ trace( m ^\a'). Then there must be a finite prefix (3 of trace(i\a) such 
that (3 ^ trace( m ^\a'). Also, there must exist a finite number j > i such that 

fi < fi\ = trace(step(a, i + 1)) " • • • " trace(step(a,j)) 

Since /3 j£ ^race( m ( 8 )|Q!'), it must also be the case that fii j£ trace( m ^\a'). Now, let 

fj' = trace(step m (a' ,i + 1)) " • • • " trace(step m (a' , j ')) 

Then, /3' < ^race( m ( 8 )|Q!') and by distributivity of restriction over concatenation fii = fi' . Thus 
/?i < trace( m ^\a'), which contradicts the assumption. So, also if |a| = oo conclude that 

trace(i\a) = trace( m ^\a'). ■ 

Lemma 6.15 

Let A and B be automata with the same external actions and let R be a relation over 
states(A) X states(B). If (a, a') £ R, then trace(a) = trace(a'). 

Proof. Immediate from Lemma 6.14 since for any execution o^, |cii = «i, and any index 
mapping maps to (cf. Condition 1 of Definition 6.6). ■ 

The soundness of the simulation relations with respect to trace inclusion can now be shown. 

Lemma 6.16 (Soundness of simulations w.r.t. trace inclusion) 

Let A and B be automata with the same external actions and assume for X £ {F, R, iB, H, iP} 
that A < x B via S . Then traces(A) C traces(B). 
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Proof. Let (3 £ traces(A) be an arbitrary trace of A and let a be an execution of A such 
that trace(a) = (3. Then, by Theorem 6.11 (ECT), there exists an execution a' of B such that 
(a, a') £ S. By Lemma 6.15, trace(a') = trace(a) = (3. Thus, (3 £ traces(B) as required. ■ 

Finally, it follows immediately from the fact that the simulation relations are sound with respect 
to trace inclusion (Lemma 6.16) and the definition of the safe preorder (Definition 3.30) that 
the simulation relations are sound with respect to the safe preorder 

Theorem 6.17 (Soundness of simulations w.r.t. the safe preorder) 

Let (A,L) and (B,M) be live I/O automata with esig(A) = esig(B), and assume for some 
X e{F,R,iB,H,iP} that A < x B. Then (A,L) C s (B,M). ■ 

6.1.4 Proving the Live Preorder 

A proof strategy for proving that one live I/O automaton implements another live I/O au- 
tomaton via the live preorder is now described. First consider the following lemma. 

Lemma 6.18 

Suppose (A,L) and (B,M) are live I/O automata with esig(A) = esig(B), and assume for 
some X £ {F,R,iB,H,iB} that A < x B via S. If 

V (a,a')e S :(ae L => a' G M) 

then (A,L) C L (B,M). 

Proof. It is enough to show that traces(L) C traces(M). Let (3 £ traces(L). By definition of 
trace there is an execution a of L such that trace(a) = (3. By definition of live I/O automaton 
a is an execution of A. From Theorem 6.11 (ECT) there exists an execution a' of B such 
that (a, a') £ S. From the hypothesis of this lemma a' is an execution of M. Moreover, from 
Lemma 6.15 we have trace(a) = trace(a'). Thus, (3 £ traces(M). ■ 

Based on Lemma 6.18, the following proof strategy proves that a live I/O automaton (A, L) is 
a correct implementation of another live I/O automaton (B,M): 

1. Prove a simulation S from A to B with respect to some invariants. 

2. Assume a and a' are arbitrary executions of A and B, respectively, and assume that a 
is live (i.e., a £ L). 

Prove that a' is also live (i.e., a' £ M). 

This will usually be a proof by contradiction. That is, assume that a' is not live and 
show that this leads to a contradiction. This strategy gives a nice way of splitting the 
proof into cases since being live usually means satisfying a conjunction of condition such 
that not being live means not satisfying one (at least) of these conditions. Thus, each of 
the conditions can be considered separately. 
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The reader is referred to [SLL93, Lyn93] for extensive applications of the proof techniques. 

6.2 Timed Proof Techniques 

Since liveness conditions in the timed model are expressed in terms of timed executions, the 
obvious generalization of the approach taken in the untimed model would be to develop simu- 
lation techniques that give a correspondence between the timed executions of timed automata. 
This suggests that the simulation techniques in the timed model should for every "timed step" 
(uj, a, a/) of a low-level timed automaton, where uj and u' are trajectories, find a corresponding 
timed execution fragment of the high-level timed automaton. On the other hand, the fact that 
the transition relation of a timed automaton determines ordinary steps of the form (s,a, s'), 
rather than steps of timed executions of the form (u,a,u'), suggests simulation techniques 
that for each ordinary step, (s,a,s'), of the low-level timed automaton find a corresponding 
(ordinary) execution fragment of the high-level timed automaton. We pursue this latter type 
of simulation. 

In particular, this section shows that the existence of such a simulation, based on ordinary 
steps, between two timed automata implies all four of the timed safe preorders of the timed 
model (cf. Definition 4.36). Also, (timed) liveness conditions can be characterized by sets of 
ordinary (sampled) executions some of which are minimal. These characterizations by sets 
of ordinary (sampled) executions form the basis of a lemma similar to Lemma 6.18 on which 
proofs of the timed live preorder can be based. 

The structure of this section parallel that of the untimed model. First a number of (timed) 
simulation techniques are defined. Then, the execution correspondence theorem for the timed 
model is proven, and finally the use of the timed simulation techniques to prove the timed safe 
and live preorders is discussed. 

6.2.1 Timed Simulation Proof Techniques 

The timed simulations presented here are similar to the ones defined in [LV91] except for our 
use of invariants. Recall, that an invariant is any set of states of an automaton that is a 
superset of the reachable states (reachability coincides with t-reachability). 

There are only two minor differences between the simulation relations presented here and 
the simulation relations from the untimed model. First, states related by a simulation relation 
must have the same time. Second, since the trace operator on execution fragments does not 
adequately abstract from time-passage actions, the simulation techniques below use a notion 
of visible trace. For any timed automaton A and any execution fragment a of A, define the 
visible trace of a, written vis-trace A (a), or just vis-trace(a) when A is clear from context, to 
be a \ vis(A). Similarly, given any sequence of actions /3, define the visible trace of/?, written 
vis-trace A (P), or just vis-trace(fi) if A is clear from context, to be (3 \ vis(A). 

Definition 6.19 (Timed forward simulation) 

Let A and B be timed automata with the same visible actions and with invariants I A and I B , 
respectively. A timed forward simulation from A to B, with respect to I A and I B , is a relation 
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/ over states(A) X states(B) that satisfies: 

1. If u G f[s] then u.now = s.now. 

2. If s G start(A) then f[s] n start(B) ^ 0. 

3. If (s,a,s') G steps(A), s,s' G /a, and u G /[s] fl Ib, then there exists an a G frag*(B) 
with fstate(a) = u, Istate(a) G /[«'], and vis-trace(a) = vis-trace(a). 

Write A < tF B if there exists a timed forward simulation from A to B with respect to some 
invariants I A and J B . If / is a timed forward simulation from A to B with respect to some 
invariants I A and J B , write A < tF B via /. ■ 

Definition 6.20 (Timed refinement mapping) 

Let A and B be timed automata with the same visible actions and with invariants I A and 
Ib, respectively. A timed refinement mapping from A to B, with respect to I A and I B , is a 
function r from states(A) to states(B) that satisfies: 

1. r(s).now = s.now. 

2. If s G start(A) then r(s) G start(B). 

3. If (s,a, s') G steps(A), s,s' G /a, and r(s) G i#, then there exists an a G frag*(B) with 
fstate(a) = r(s), Istate(a) = r(s'), and vis-trace(a) = vis-trace(a). 

Write A < tR B if there exists a timed refinement mapping from A to B with respect to some 
invariants I A and J B . If r is a timed refinement mapping from A to B with respect to some 
invariants I A and J B , write A < tR B via r. ■ 

Definition 6.21 (Timed backward simulation) 

Let A and B be timed automata with the same visible actions and with invariants I A and 
Ib, respectively. A timed backward simulation from A to B, with respect to I A and Ib, is a 
relation b over states(A) X states(B) that satisfies: 

1. If u G &[s] then u.now = s.now. 

2. If s G /a then b[s] l~l 7 B 7^ 0. 

3. If s G start(A) then 6[s] l~l i" B C start (B). 

4. If (s,a,s') G steps(A), s,s' G /a, and m' G b[s'] P\ Ib, then there exists an a G frag*(B) 
with Istate(a) = u' , fstate(a) G &[s] fl 7^, and vis-trace(a) = vis-trace(a). 
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Write A < tB B if there exists a timed backward simulation from A to B with respect to some 
invariants I A and I B . If furthermore the timed backward simulation is image-finite, write 
A <hb B. If b is a timed backward simulation from A to B with respect to some invariants 
I a and I B , write A < tB B (or A <hb B when b is image-finite) via b. ■ 

Definition 6.22 (Timed history relation) 

Let A and B be timed automata with the same visible actions and with invariants I A and I B , 
respectively. A relation h over states(A) X states(B) is a timed history relation from A to _B, 
with respect to I A and J B , if h is a timed forward simulation from A to B with respect to i^ 
and I B , and /i _1 is a timed refinement mapping from B to A, with respect to I B and i^. 

Write A < tH B if there exists a timed history relation from A to B with respect to some 
invariants I A and J B . If h is a timed history relation from A to B with respect to some 
invariants I A and J B , write A < tH B via /i. ■ 

Definition 6.23 (Timed prophecy relation) 

Let A and B be timed automata with the same visible actions and with invariants I A and I B , 
respectively. A relation p over states(A) X states(B) is a timed prophecy relation from A to B, 
with respect to i^ and I B , if p is a timed backward simulation from A to _B with respect to I A 
and J B , and p _1 is a timed refinement mapping from B to A, with respect to I B and i^. 

Write A < tP B if there exists a timed prophecy relation from A to B with respect to some 
invariants I A and I B . If furthermore the timed prophecy relation is image-finite, write A <np 
B. If p is a prophecy relation from A to B with respect to some invariants I A and J B , write 
A <tp B (or A <np B when p is image-finite) via p. ■ 

6.2.2 Execution Correspondence 

As in the untimed model, the simulation relations imply a certain correspondence between the 
ordinary executions of the involved timed automata. The following definition formalizes this 
correspondence, called timed R-relation, and defines a notion of timed index mapping. The 
definition is similar to Definition 6.6 in the untimed model; the only differences are that the R 
relation must relate states with the same time and that the definition deals with visible traces 
as opposed to traces, i.e., the same differences as in the simulation relations. 

Definition 6.24 (Timed i?-relation and timed index mappings) 

Let A and B be timed automata with the same external actions and let R be a relation over 
states(A) X states(B) such that if (s,u) £ R then s.now = u.now. Furthermore, let a and a' 
be (ordinary) executions of A and B, respectively. 

a = s ais 1 a 2 s 2 • • • 
a' = u biUib 2 u 2 ■ ■ ■ 
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Let a and a' be timed R-related, written (a, a') G< R, if there exists a total, nondecreasing 
mapping m : {0, 1, . . ., |a|} — ► {0, 1, . . ., |a'|} such that 

1. m(0) = 0, 

2. (sj,tt m (j)) G -R for all < i < \a\, 

3. vis-trace(b m (i_i^ + i ■ ■ -b m ^) = vis-trace(ai) for all < i < \a\, and 

4. for all j, < j < \a'\, there exists an i, < i < |a|, such that ra(i) > j. 

The mapping to is referred to as a timed index mapping from a to a' with respect to R. 

Write (A, B) 6* i? if for every execution a of A, there exists an execution a 1 of i? such that 
(a, a') e t R. ■ 

The following lemma shows that timed i?-related executions have the same limit time and that 
there is a correspondence with respect to finiteness, admissibility, and Zenoness. 

Lemma 6.25 

Let A and B be timed automata with the same external actions and let R be a relation over 
states(A) X states(B) such that if (s,u) G R then s.now = u.now. Furthermore, let a and a' 
be executions of A and B, respectively. Then, if (a, a') G< R 

1. Itime(a) = Itime(a'), 

2. if a is finite then a 1 is finite, 

3. a is admissible iff a' is admissible, and 
4- if a' is Zeno then a is Zeno. 

Proof. Let a = s ais 1 a 2 s 2 • • • and a' = u biUib 2 u 2 ■ ■ •, and assume (a, a') G< R. Let m be 
a timed index mapping from a to a with respect to R. The four parts of the lemma are 
considered separately. 

1. For any state sin a (and thus any time in a) there exists, by Condition 2 of Defini- 
tion 6.24, a state u in a' with (s,u) G R, and thus u.now = s.now. This proves that 
Itime(a) < Itime(a'). Similarly Condition 4 of Definition 6.24 implies that Itime(a) > 
Itime(a'). Thus, Itime(a) = Itime(a'). 

2. Assume a is finite. Now, assume that a' is not finite. Let m' = m(\a\). Then, since 
a 1 is not finite and thus infinite, the state w m < +1 exists in a'. Then Condition 4 of 
Definition 6.24 implies the existence of an index < i < \a\ such that m(i) > ra' + l > to', 
but this contradicts the fact that m' = ra(|a|), and m is nondecreasing. Thus, a 1 is finite. 

3. This result follows directly from Part 1 of this lemma. 
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4. Assume a 1 is Zeno. Then Part 2 of this lemma implies that a is not finite. Furthermore, 
Part 3 of this lemma implies that a is not admissible. Thus, a is Zeno. 

This concludes the proof. ■ 

Note that in Part 2 of Lemma 6.25 the converse is not true: even though a 1 is finite, a could 
be Zeno by having a suffix containing only internal actions and having m be constant for all 
indices in that suffix. This argument shows that the converse of Part 4 is also not true in 
general. 

Now the Execution Correspondence Theorem can be stated for the timed model. 

Theorem 6.26 (Execution Correspondence Theorem) 

Let A and B be timed automata with the same visible actions. Assume for X £ {tF,tR,itB, 
tH,itP} that A< x B via S. Then (A,B) £ t S. 

Proof. Similar to the ECT proof in the untimed model (Theorem 6.11). ■ 

6.2.3 Proving the Timed Safe Preorders 

Due to the fact that timed i?-related executions have the same time in related states and have 
a correspondence between the their visible traces, it is possible to prove that timed i?-related 
executions have the same timed traces. 

Lemma 6.27 

Let A and B be timed automata with the same external actions and let R be a relation over 
states(A) X states(B) such that if(s,u) £ R then s.now = u.now. Then, if (a, a') £ t R, then 
t-trace(a) = t-trace(a'). 

Proof. Similar to the proofs of Lemmas 6.14 and 6.15. ■ 

Soundness of the timed simulations with respect to timed trace inclusion now follows. 

Lemma 6.28 (Soundness of timed simulations w.r.t. timed trace inclusion) 

Let A and B be timed automata with the same external actions. Assume for X £ {tF, tR, itB, 
tH, UP} that A < x B. Then 

1. t-traces(A) C t-traces(B) 

2. t-traces*(A) C t-traces*(B) 

3. t-traces°°(A) C t-traces°° (B) 

Proof. Consider the three parts separately. 
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1. Suppose 7 G t-traces(A). Then by definition there exists a timed execution X G t-exec(A) 
such that t-trace(Yi) = 7. Now, the sampling results of Lemmas 4.4 and 4.7 imply 
the existence of an execution a G exec(A) with t-trace(a) = t-trace(T,). Then ECT 
(Theorem 6.26) and Lemma 6.27 imply the existence of an execution a' G exec(B) such 
that t-trace(a') = t-trace(a). Finally, the sampling results of Lemmas 4.3 and 4.7 give 
the existence of a timed execution £' G t-exec(B) with t-trace(Yi') = t-trace(a'). 

Thus, t-trace(Yi') = t-trace(a') = t-trace(a) = t-trace(T,) = 7. Therefore 7 G t-traces(B). 
That suffices. 

2. Similar to Part f. Also use Lemma 6.25 Part 2 and Lemma 4.6 Part f to prove the 
following: if X is finite then a, a', and £' are also finite. Then the result follows. 

3. Similar to Part 2. Use Lemma 6.25 Part 3 and Lemma 4.6 Part 2. ■ 

Based on this lemma, the soundness of the timed simulations with respect to the timed safe 
preorders can be shown. 

Theorem 6.29 (Soundness of timed simulations w.r.t. the timed safe preorders) 

Let (A,L) and (B,M) be live timed I/O automata with vsig(A) = vsig(B), and assume for 
some X G {tF,tR,itB,tH,itP} that A < x B. Then 

1. A C st B 

2. A Q* st B 

3. iC™ B 

4. A C- B 

Proof. Parts f-3 follow directly from Lemma 6.28 Parts f-3 and the definition of the timed 
safe preorders (Definition 4.36). Part 4 follows, by Definition 4.36, from Parts 2 and 3. ■ 

6.2.4 Proving the Timed Live Preorder 

It is possible to characterize timed liveness conditions by a set of ordinary executions such that 
a lemma like Lemma 6.18 (based on the timed simulation techniques above) can be stated. 
Start by defining such (minimal) sampling characterizations of liveness conditions. 

Definition 6.30 ((Minimal) sampling characterizations) 

Let (A,L) be a live timed I/O automaton. A set L C exec(A) is a sampling characterization 
of L if L = {S G t-exec°° (A) \ for all a G exec(A) where a samples S, a G L }. 

Furthermore, L is said to be minimal if it equals the set of all samplings of all timed executions 
in L. m 
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For any live timed I/O automaton (A,L), L has a minimal sampling characterization L , 
namely the one containing all samplings of the timed executions in L. 

Lemma 6.31 

Let (A, L) and (B, M) be live timed I/O automata with vsig(A) = vsig(B). Assume that L and 
M are sampling characterizations of L and M , respectively, and assume that M is minimal. 
Assume for some X £ {tF,tR,itB,tH,itP} that A < x B via S. If 

V (a, a') e t S : (a e L => a' e M ) 

then (A,L) C Lt (B,M). 

Proof. Let 7 £ t-trace(L) be an arbitrary timed trace of L and let X £ L with t-trace(T,) = 7. 
Based on the sampling result of Lemma 4.4 and the fact that L is a sampling characterization 
of L, there exists an execution a £ exec(A) such that a samples X and a £ L . Based on the 
sampling results of Lemmas 4.6 and 4.7, a is admissible and t-trace(a) = 7. Then by ECT 
(Theorem 6.26) there exists an a' £ exec(B) such that (a, a') £ t S. Lemmas 6.25 and 6.27 
imply that a' is admissible and t-trace(a') = 7. By the hypothesis in this lemma, a 1 £ M . 
Then, based on the sampling results of Lemmas 4.3, 4.6, and 4.7, there exists a £' £ t-exec°° (B) 
with t-trace(T, r ) = 7. Now, since M is a minimal sampling characterization of M, S £ M and 
thus 7 £ t-traces(M). By definition of C Lt (Definition 4.36) this suffices. ■ 

Lemma 6.31 can be used to prove the live preorder between two live timed I/O automata in 
a manner similar to the way Lemma 6.18 is used in the untimed model. However, one must 
first find sampling characterizations of the liveness conditions. Furthermore, the sampling 
characterization for the high-level liveness condition must be minimal. In practice the liveness 
condition L of a live timed I/O automaton is often defined as those timed executions that 
have all their samplings in some set of ordinary executions L , which, in turn, could be those 
executions that satisfy some formula in a temporal logic. In this case L is, by definition, a 
sampling characterization of L. Then, the only remaining proof obligation is to show that the 
sampling characterization of the high-level live timed I/O automaton is minimal. In [SLL93] 
there is an example of the use of Lemma 6.31 

7 Concluding Remarks 

This paper extends I/O automata [LT87, MMT91] to handle general liveness properties in both 
the timed and untimed model, and creates a coordinate framework where timed and untimed 
systems can be analyzed. A key aspect of the models is the notion of environment-freedom, 
which expresses the fact that a live (timed) I/O automaton does not constrain its environment. 
Moreover, the simulation method of [AL91a, LV91, LV93a, LV93b, Jon91] is extended to our 
model, making the results of this paper immediately applicable in practice. A substantial 
verification project using the model appears in [SLL93, LLS93]. In addition to generalizing 
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the I/O automaton model [LT87] and its timed version [MMT91], our model generalizes the 
failure free complete trace structures of [Dil88] and the strong I/O feasibility notion of [VL92]. 

People familiar with process algebras might object to our model, arguing that environment- 
freedom is too restrictive since it rules out several systems that might be of interest at a high 
level of abstraction. We recognize this objection and regard the generalization of the model 
as future work. In fact, our model is closer to the classical models of the process algebraic 
community than the models of [AL93, AL91b], and thus may represent a natural starting point 
for possible generalizations. Some promising results come from [Seg93], which shows that there 
is a strong connection between the trace semantics of I/O automata and the MUST preorder of 
the theory of testing [DH84]. 

Another line of research consists of extending the current model to handle systems with 
probabilistic behaviors. The ultimate goal would be a model where probabilistic behaviors, 
timing constraints, safety properties, and liveness properties can be integrated together. 
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